admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-08-17 15:56:15 -07:00
committed by GitHub
parent 88b7aaea73 e1b1b99cba
commit 43b52f7cf3
3 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml
+2 -3
View File
@@ -25,9 +25,8 @@ references:
- https://twitter.com/jhencinski/status/1618660062352007174
tags:
analytic_story:
- Compromised User Account
- Azure Active Directory Account Takeover
asset_type: Azure Active Directory
- AWS Identity and Access Management Account Takeover
asset_type: AWS Account
confidence: 80
impact: 80
message: A new virtual device is added to user $identity.user.name$
detections/cloud/aws_new_mfa_method_registered_for_user.yml
+2 -3
View File
@@ -25,9 +25,8 @@ references:
- https://twitter.com/jhencinski/status/1618660062352007174
tags:
analytic_story:
- Compromised User Account
- Azure Active Directory Account Takeover
asset_type: Azure Active Directory
- AWS Identity and Access Management Account Takeover
asset_type: AWS Account
confidence: 80
impact: 80
message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$
detections/endpoint/disable_etw_through_registry.yml
+3 -3
View File
@@ -5,7 +5,7 @@ date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: this search is to identify modification in registry to disable ETW windows
description: This search is to identify modification in registry to disable ETW windows
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
@@ -13,7 +13,7 @@ data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.dest Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
@@ -32,7 +32,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: Disable ETW Through Registry
message: Disable ETW Through Registry on $dest$
mitre_attack_id:
- T1562.001
- T1562