From cb7523dfd90e216321a80159c947f612f3871bf0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 7 Jul 2022 17:46:24 +0200 Subject: [PATCH 1/8] fix-join-issue2 --- .../office_product_writing_cab_or_inf.yml | 31 +++++++++++-------- .../suspicious_wav_file_in_appdata_folder.yml | 26 +++++++++------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 1affe30763..f52fc2428d 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -1,8 +1,8 @@ name: Office Product Writing cab or inf id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 1 -date: '2021-09-10' -author: Michael Haag, Splunk +version: 2 +date: '2022-07-07' +author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,16 +10,21 @@ description: The following analytic identifies behavior related to CVE-2021-4044 Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process] | dedup file_create_time | table dest, process_name, process, file_create_time, - file_name, file_path | `office_product_writing_cab_or_inf_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | join proc_guid, _time [ + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.inf","*.cab") + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid + | `office_product_writing_cab_or_inf_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index ff532958aa..fa79a58594 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 1 -date: '2021-09-21' +version: 2 +date: '2022-07-07' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -12,15 +12,19 @@ description: This analytic is to detect a suspicious creation of .wav file in ap to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path - process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | join proc_guid, _time [ + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] + | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least From 10aa2d0a0a2ee2048237aebbac0cd113f3a7cb94 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 7 Jul 2022 17:55:57 +0200 Subject: [PATCH 2/8] Update office_product_writing_cab_or_inf.yml --- detections/endpoint/office_product_writing_cab_or_inf.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index f52fc2428d..b906212777 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -2,7 +2,7 @@ name: Office Product Writing cab or inf id: f48cd1d4-125a-11ec-a447-acde48001122 version: 2 date: '2022-07-07' -author: Michael Haag, Teoderick Contreras, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint From 1e6f2d79b0e98f5ebb615ac30d149a57059b7f1c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 12:48:25 -0700 Subject: [PATCH 3/8] Don't modify the original search variable. This can cause problems if we need to run the search again. --- bin/docker_detection_tester/modules/splunk_sdk.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 2dc6c36556..4e0c01a8bb 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -192,15 +192,15 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass # search = search.replace('\\','\\\\') if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": earliest_time, "dispatch.latest_time": latest_time} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition try: job = service.jobs.create(splunk_search, **kwargs) @@ -233,15 +233,15 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, attempts_remaining -= 1 if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": "-1d", "dispatch.latest_time": "now"} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition test_results = dict() #These will always be present. By default, we will say that the From ccbe770e211ea0e44668b97a7477b20d4055f960 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 12:53:51 -0700 Subject: [PATCH 4/8] Modify all tests that fail in gha but pass in local testing for easier troubleshooting. --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- .../endpoint/disable_security_logs_using_minint_registry.yml | 2 +- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- .../endpoint/enable_wdigest_uselogoncredential_registry.yml | 2 +- detections/endpoint/etw_registry_disabled.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/linux_deletion_of_init_daemon_script.yml | 2 +- detections/endpoint/linux_deletion_of_ssl_certificate.yml | 2 +- .../linux_high_frequency_of_file_deletion_in_etc_folder.yml | 2 +- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- detections/endpoint/revil_registry_entry.yml | 2 +- detections/endpoint/sdclt_uac_bypass.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- .../windows_disable_change_password_through_registry.yml | 2 +- ...indows_disable_lock_workstation_feature_through_registry.yml | 2 +- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- detections/endpoint/windows_disable_notification_center.yml | 2 +- .../windows_disable_shutdown_button_through_registry.yml | 2 +- .../windows_hide_notification_features_through_registry.yml | 2 +- .../endpoint/windows_installutil_remote_network_connection.yml | 2 +- ...windows_modify_show_compress_color_and_info_tip_registry.yml | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 86c46d70eb..84d832ffb0 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -2,7 +2,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4aace03422..c71a4169df 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index b55567d231..f20194e2c4 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -2,7 +2,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index dcd559b377..cf59998215 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -2,7 +2,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index cfe318454b..739083e0eb 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -2,7 +2,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 version: 2 date: '2022-01-27' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index f6e063ff1c..69747cc199 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -2,7 +2,7 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 828b657127..3811e05899 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 56af0e84d8..16df2a4524 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -2,7 +2,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7948f3ac6b..78c9f29b51 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index cee914c96d..828c6b477a 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -2,7 +2,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index f90ac8ec8b..6cfaea1834 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -2,7 +2,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 0a1cf8a04a..1e2e8622bd 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -2,7 +2,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5028c90de0..484eb2eff5 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk +author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index e0ae661df2..0318c8cc24 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -2,7 +2,7 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 2 date: '2021-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 6e0bfbad04..b07341e7e5 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -2,7 +2,7 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 version: 2 date: '2020-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 344ea9a9db..8ecf2b571f 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -2,7 +2,7 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index a371b5cff6..403ece237d 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index eaf42461b5..b940ece67a 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 2762afa09d..47cd1bc6ea 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -2,7 +2,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b5e0d89819..d629aa56d5 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 1 date: '2022-02-17' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 835040e6b0..af7553c113 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6f5e2c783a..23ea3edaa3 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index dffd5a950f..ca2d10e1fa 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 2 date: '2022-03-16' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index c7538027c5..4312501bcd 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint From 71b7c5d45cbb46a0518b47047faba5ce3f706711 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 14:06:01 -0700 Subject: [PATCH 5/8] Forgot to specify the host that data was being uploaded from. This means that delete does not work as expected, causing a large number of tests to fail and slower searches. --- bin/docker_detection_tester/modules/testing_service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 72b39cfc69..23a526c5fa 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -122,7 +122,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa test_index = service.indexes[data_upload_index] with open(target_file, 'rb') as target: - test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source']) + test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source'], host=splunk_sdk.DEFAULT_EVENT_HOST) except http.client.HTTPException as e: raise(Exception(f"Failed to submit detection file {target_file} to Splunk Server: {str(e)}")) From d8458b882ec6a460c374e27689c7f2e07b16a212 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 14:31:02 -0700 Subject: [PATCH 6/8] Quick hack to get everything tested in GHA using this verison of the CI/CD code. --- .github/workflows/detection-testing.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index a2bba1b154..1526997a74 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -79,7 +79,7 @@ jobs: echo "github.event_name : [${{ github.event_name }}]" - if [[ ${{ github.event_name }} == schedule ]]; then + if [[ ${{ github.event_name }} == schedule ]] || [[ true = true ]]; then # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches! echo "Running a nightly test on all detections OR a commit was made directly to develop" python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json @@ -140,7 +140,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 with: - ref: develop + ref: resolve_local_gha_delta - name: Download artifacts uses: actions/download-artifact@v2 From bf127dc0c0604c4d69e24f5d38cbc48a63d06847 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 12 Jul 2022 08:39:08 -0700 Subject: [PATCH 7/8] Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works. --- .../authorize.conf.tar | Bin 2048 -> 2048 bytes .../modules/splunk_sdk.py | 43 +++--------------- 2 files changed, 7 insertions(+), 36 deletions(-) diff --git a/bin/docker_detection_tester/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar index 3a624a3b27a8fc5451df076403d5db682ca9c90e..a525572e5ba253077e89f845ae279d9d9eadd1b7 100644 GIT binary patch delta 84 zcmZn=Xb_lCp=w~Dz+eCc#>R#Uh9*X4#)if~(oDg?(A2=xj6uO*aw22OWJX2}*7A(h h)SQWe(wjXQ?HSopQgc#EQYYs!c`Tq0KNGW5C8xG diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 4e0c01a8bb..f930e7531b 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -317,6 +317,12 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, indices:list[str]=[DEFAULT_DATA_INDEX], host:str=DEFAULT_EVENT_HOST)->bool: + if wait_on_delete: + print(wait_on_delete['message']) + print("FILENAME : [%s]"%(detection_filename)) + print("SEARCH :\n%s"%(search_string)) + _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") + try: service = client.connect( host=splunk_host, @@ -329,21 +335,11 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa raise(Exception("Unable to connect to Splunk instance: " + str(e))) - #splunk_search = 'search index=test* | delete' - if wait_on_delete: - print(wait_on_delete['message']) - print("FILENAME : [%s]"%(detection_filename)) - print("SEARCH :\n%s"%(search_string)) - _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") - - data_exists = True - #print(f"Deleting data for {detection_filename}: {indices}") for index in indices: while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : splunk_search = f'search index="{index}" host="{host}" | delete' - kwargs = { "exec_mode": "blocking", "dispatch.earliest_time": "-1d", @@ -353,34 +349,9 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa job = service.jobs.create(splunk_search, **kwargs) reader = results.ResultsReader(job) - - ''' - error_in_results = False - for result in reader: - if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"): - print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr) - if already_enabled_delete is True: - print("We already enabled delete, but the setting did not take effect.") - raise(Exception("Enabling delete command failed to take effect")) - if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True: - raise(Exception("Failure enabling delete for admin. We cannot continue")) - # We enabled delete, so now we will try to delete again - already_enabled_delete = True - break - else: - #This is not one of the error messages, do nothing - pass - ''' - #No need to issue Delete command again, we will now break out of the loop - #if error_in_results is False: - # data_exists = False - - #Otherwise, we will loop again except Exception as e: - print(f"Trouble deleting data from a run.... we will try again: {str(e)}") - time.sleep(5) - #raise(Exception("Unable to delete data from a run: " + str(e))) + raise(Exception(f"Trouble deleting data using the search {splunk_search}: {str(e)}")) return True From f8ac5616a0d8bba7fe03513adabe0cdb219c58b5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 12 Jul 2022 10:08:07 -0700 Subject: [PATCH 8/8] Reverting the workflow and all of the detections that were touched to their original versions. --- .github/workflows/detection-testing.yml | 4 ++-- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- .../endpoint/disable_defender_enhanced_notification.yml | 2 +- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- .../endpoint/disable_security_logs_using_minint_registry.yml | 2 +- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- .../endpoint/enable_wdigest_uselogoncredential_registry.yml | 2 +- detections/endpoint/etw_registry_disabled.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/linux_deletion_of_init_daemon_script.yml | 2 +- detections/endpoint/linux_deletion_of_ssl_certificate.yml | 2 +- .../linux_high_frequency_of_file_deletion_in_etc_folder.yml | 2 +- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- detections/endpoint/revil_registry_entry.yml | 2 +- detections/endpoint/sdclt_uac_bypass.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- .../windows_disable_change_password_through_registry.yml | 2 +- ...dows_disable_lock_workstation_feature_through_registry.yml | 2 +- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- detections/endpoint/windows_disable_notification_center.yml | 2 +- .../windows_disable_shutdown_button_through_registry.yml | 2 +- .../windows_hide_notification_features_through_registry.yml | 2 +- .../windows_installutil_remote_network_connection.yml | 2 +- ...ndows_modify_show_compress_color_and_info_tip_registry.yml | 2 +- 25 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 1526997a74..a2bba1b154 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -79,7 +79,7 @@ jobs: echo "github.event_name : [${{ github.event_name }}]" - if [[ ${{ github.event_name }} == schedule ]] || [[ true = true ]]; then + if [[ ${{ github.event_name }} == schedule ]]; then # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches! echo "Running a nightly test on all detections OR a commit was made directly to develop" python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json @@ -140,7 +140,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 with: - ref: resolve_local_gha_delta + ref: develop - name: Download artifacts uses: actions/download-artifact@v2 diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 84d832ffb0..86c46d70eb 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -2,7 +2,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index c71a4169df..4aace03422 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index f20194e2c4..b55567d231 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -2,7 +2,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index cf59998215..dcd559b377 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -2,7 +2,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 739083e0eb..cfe318454b 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -2,7 +2,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 version: 2 date: '2022-01-27' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 69747cc199..f6e063ff1c 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -2,7 +2,7 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 3811e05899..828b657127 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 16df2a4524..56af0e84d8 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -2,7 +2,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 78c9f29b51..7948f3ac6b 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 828c6b477a..cee914c96d 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -2,7 +2,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 6cfaea1834..f90ac8ec8b 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -2,7 +2,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 1e2e8622bd..0a1cf8a04a 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -2,7 +2,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 484eb2eff5..5028c90de0 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk +author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 0318c8cc24..e0ae661df2 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -2,7 +2,7 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 2 date: '2021-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index b07341e7e5..6e0bfbad04 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -2,7 +2,7 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 version: 2 date: '2020-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 8ecf2b571f..344ea9a9db 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -2,7 +2,7 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 403ece237d..a371b5cff6 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index b940ece67a..eaf42461b5 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 47cd1bc6ea..2762afa09d 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -2,7 +2,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index d629aa56d5..b5e0d89819 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 1 date: '2022-02-17' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index af7553c113..835040e6b0 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 23ea3edaa3..6f5e2c783a 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index ca2d10e1fa..dffd5a950f 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 2 date: '2022-03-16' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 4312501bcd..c7538027c5 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint