diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index d4cdc813b6..223f9a1c16 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -4,8 +4,7 @@ version: 2 date: '2021-11-18' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 3f8090e1e6..eb2c580a34 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-18' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the usage of the `Enter-PSSession`. This commandlet can be used to open an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 15389b529a..9bfba7f9c8 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 3482d16ebd..e11ab6af7d 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-16' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index abd9d37eec..5d9f138111 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index c3fa2d88f7..59d1a719bc 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -4,8 +4,7 @@ version: 2 date: '2021-11-22' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 483bbb5954..af64377a16 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path is located in public paths. This behavior could represent the installation of a malicious service. diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index 197d64c2c3..5d4a7ebb1a 100644 --- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-29' author: Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, this analytic also leverages the `ut_shannon` diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml index ea1bffb29f..7f857f29e1 100644 --- a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-29' author: Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, this analytic also diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml index c382b71c0d..68f71a22c7 100644 --- a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-12-01' author: Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: 'The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects to a remote diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index 47668c6ddf..416425faf7 100644 --- a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-12-01' author: Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: 'The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of