| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
-| [](https://nvd.nist.gov/vuln/detail/) | | |
+| [CVE-2022-26889](https://nvd.nist.gov/vuln/detail/CVE-2022-26889) | The lack of sanitization in a relative url path in a search parameter allows for arbitrary injection of external content in Splunk Enterprise versions before 8.1.2. | 7.5 |
diff --git a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md
index 08a8f6fe4a..91b1cc0166 100644
--- a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md
+++ b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md
@@ -16,12 +16,12 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- -
+ - CVE-2021-33845
---
-[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
#### Description
@@ -95,7 +95,7 @@ On May 3rd, 2022, Splunk published a security advisory for username enumeration
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
-| [](https://nvd.nist.gov/vuln/detail/) | | |
+| [CVE-2021-33845](https://nvd.nist.gov/vuln/detail/CVE-2021-33845) | The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. | 5.0 |
diff --git a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md
index 6e5c9ab5fa..86709b7a4c 100644
--- a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md
+++ b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md
@@ -21,7 +21,7 @@ tags:
-[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
#### Description
@@ -144,7 +144,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed.
#### Associated Analytic story
-* [Cyclops BLink](/stories/cyclops_blink)
+* [CyclopsBLink](/stories/cyclopsblink)
diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
index 535738338f..07d11a427a 100644
--- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
+++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
@@ -21,7 +21,7 @@ tags:
-[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
#### Description
@@ -138,7 +138,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
unknown
#### Associated Analytic story
-* [Cyclops BLink](/stories/cyclops_blink)
+* [CyclopsBLink](/stories/cyclopsblink)
diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md
index 2934bda36f..706e4af649 100644
--- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md
+++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md
@@ -19,7 +19,7 @@ tags:
-[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
#### Description
@@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md
new file mode 100644
index 0000000000..e79bf89f38
--- /dev/null
+++ b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md
@@ -0,0 +1,152 @@
+---
+title: "Detect AWS Console Login by New User"
+excerpt: ""
+categories:
+ - Cloud
+last_modified_at: 2022-05-10
+toc: true
+toc_label: ""
+tags:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Authentication
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
+- **Last Updated**: 2022-05-10
+- **Author**: Rico Valdez, Splunk
+- **ID**: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Actions on Objectives
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.DP
+* DE.AE
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user
+| `drop_dm_object_name(Authentication)`
+| join user type=outer [ inputlookup previously_seen_users_console_logins
+| stats min(firstTime) as earliestseen by user]
+| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User")
+| where userStatus="First Time Logging into AWS Console"
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `detect_aws_console_login_by_new_user_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that **detect_aws_console_login_by_new_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Lookups
+The SPL above uses the following Lookups:
+
+* [previously_seen_users_console_logins](https://github.com/splunk/security_content/blob/develop/lookups/previously_seen_users_console_logins.yml) with [data](https://github.com/splunk/security_content/tree/develop/lookups/previously_seen_users_console_logins.csv)
+
+#### Required field
+* _time
+* Authentication.signature
+* Authentication.user
+
+
+#### How To Implement
+You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
+
+#### Known False Positives
+When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
+
+#### Associated Analytic story
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 30.0 | 50 | 60 | User $user$ is logging into the AWS console for the first time |
+
+
+#### Reference
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/detect_aws_console_login_by_new_user.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md
new file mode 100644
index 0000000000..95add92e97
--- /dev/null
+++ b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md
@@ -0,0 +1,167 @@
+---
+title: "F5 BIG-IP iControl REST Vulnerability CVE-2022-1388"
+excerpt: "Exploit Public-Facing Application
+"
+categories:
+ - Network
+last_modified_at: 2022-05-10
+toc: true
+toc_label: ""
+tags:
+ - Exploit Public-Facing Application
+ - Initial Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - CVE-2022-1388
+ - Web
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a recent unauthenticated remote code execution vulnerablity against the F5 BIG-IP iControl REST API. The analytic identifies the URI path found in the POCs and the HTTP Method of POST. In addition, the request header will have the commands that may be executed in fields utilcmdargs and the auth field of X-F5-Auth-Token, which may have a random base64 encoded value.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Last Updated**: 2022-05-10
+- **Author**: Michael Haag, Splunk
+- **ID**: bb1c2c30-107a-4e56-a4b9-1f7022867bfe
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-1388](https://nvd.nist.gov/vuln/detail/CVE-2022-1388) | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 7.5 |
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats count from datamodel=Web where Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest
+| `drop_dm_object_name("Web")`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that **f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* Web.http_method
+* Web.url
+* Web.url_length
+* Web.src
+* Web.dest
+* Web.http_user_agent
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
+
+#### Known False Positives
+False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
+
+#### Associated Analytic story
+* [F5 BIG-IP Vulnerability CVE-2022-1388](/stories/f5_big-ip_vulnerability_cve-2022-1388)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 70.0 | 100 | 70 | An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred. |
+
+
+#### Reference
+
+* [https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml](https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml)
+* [https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/](https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/)
+* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388)
+* [https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ](https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ)
+* [https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py](https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/f5/f5.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/f5/f5.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
new file mode 100644
index 0000000000..ba3b04989c
--- /dev/null
+++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
@@ -0,0 +1,177 @@
+---
+title: "AWS Create Policy Version to allow all resources"
+excerpt: "Cloud Accounts
+, Valid Accounts
+"
+categories:
+ - Cloud
+last_modified_at: 2022-05-17
+toc: true
+toc_label: ""
+tags:
+ - Cloud Accounts
+ - Valid Accounts
+ - Defense Evasion
+ - Initial Access
+ - Persistence
+ - Privilege Escalation
+ - Defense Evasion
+ - Initial Access
+ - Persistence
+ - Privilege Escalation
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-17
+- **Author**: Bhavin Patel, Splunk
+- **ID**: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Actions on Objectives
+
+
+
+
+
+
+
+ NIST
+
+
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 13
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success
+| spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{}
+| mvexpand key_policy_statements
+| spath input=key_policy_statements output=key_policy_action_1 path=Action
+| where key_policy_action_1 = "*"
+| stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion user user_arn
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+|`aws_create_policy_version_to_allow_all_resources_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* eventName
+* userAgent
+* errorCode
+* eventSource
+* requestParameters.userName
+* requestParameters.policyDocument
+* aws_account_id
+* awsRegion
+* eventID
+
+
+#### How To Implement
+You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+
+#### Known False Positives
+While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
+
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | User $user$ created a policy version that allows them to access any resource in their account. |
+
+
+#### Reference
+
+* [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws)
+* [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_stories/cyclopsblink.md b/docs/_stories/cyclopsblink.md
index 9434bc9faa..49ed3cec2d 100644
--- a/docs/_stories/cyclopsblink.md
+++ b/docs/_stories/cyclopsblink.md
@@ -7,6 +7,8 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
+ - Endpoint
+ - Exploitation
---
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -16,7 +18,7 @@ tags:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc. Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices. The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. The modular malware consists of core components and modules that are deployed as child processes using the Linux API fork. At this point, four modules have been identified that download and upload files, gather system information and contain updating mechanisms for the malware itself. Additional modules can be downloaded and executed from the command and control (C2) server.
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**:
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2022-04-07
- **Author**: Teoderick Contreras, Splunk
- **ID**: 7c75b1c8-dfff-46f1-8250-e58df91b6fd9
@@ -29,6 +31,9 @@ Adversaries may use this technique to maximize the impact on the target organiza
| Name | Technique | Type |
| ----------- | ----------- |--------------|
+| [Linux Iptables Firewall Modification](/endpoint/linux_iptables_firewall_modification/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Linux Kworker Process In Writable Process Path](/endpoint/linux_kworker_process_in_writable_process_path/) | [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading)| Hunting |
+| [Linux Stdout Redirection To Dev Null File](/endpoint/linux_stdout_redirection_to_dev_null_file/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
#### Reference
diff --git a/docs/_stories/f5_big-ip_vulnerability_cve-2022-1388.md b/docs/_stories/f5_big-ip_vulnerability_cve-2022-1388.md
new file mode 100644
index 0000000000..f4561a9a75
--- /dev/null
+++ b/docs/_stories/f5_big-ip_vulnerability_cve-2022-1388.md
@@ -0,0 +1,46 @@
+---
+title: "F5 BIG-IP Vulnerability CVE-2022-1388"
+last_modified_at: 2022-05-10
+toc: true
+toc_label: ""
+tags:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Web
+ - Exploitation
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Last Updated**: 2022-05-10
+- **Author**: Michael Haag, Splunk
+- **ID**: 0367b177-f8d6-4c4b-a62d-86f52a590bff
+
+#### Narrative
+
+CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks'' BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5''s iControl REST authentication. The vulnerability was first discovered by F5''s internal product security team and disclosed publicly on May 4, 2022, per Randori. This vulnerability,CVE-2022-1388, may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only per F5 article K23605346. Is CVE-2022-1388 Exploitable? Yes. There are now multiple POC scripts available and reports of threat actors scanning and potentially exploiting the vulnerablity. Per Randori the specific interface needed to exploit this vulnerability is rarely publicly exposed, and the risk to most organizations of exploitation by an unauthenticated external actor is low.
+
+#### Detections
+
+| Name | Technique | Type |
+| ----------- | ----------- |--------------|
+| [F5 BIG-IP iControl REST Vulnerability CVE-2022-1388](/network/f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP |
+
+#### Reference
+
+* [https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml](https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml)
+* [https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/](https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/)
+* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388)
+* [https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ](https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ)
+* [https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py](https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/f5_big-ip_vulnerability_cve-2022-1388.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/hermetic_wiper.md b/docs/_stories/hermetic_wiper.md
index 918d838175..6bb9d1eb53 100644
--- a/docs/_stories/hermetic_wiper.md
+++ b/docs/_stories/hermetic_wiper.md
@@ -66,7 +66,7 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information)| TTP |
+| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
@@ -76,7 +76,7 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
-| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses), [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell)| TTP |
| [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction)| TTP |
| [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction)| TTP |
diff --git a/docs/_stories/insider_threat.md b/docs/_stories/insider_threat.md
new file mode 100644
index 0000000000..0d932c5c23
--- /dev/null
+++ b/docs/_stories/insider_threat.md
@@ -0,0 +1,53 @@
+---
+title: "Insider Threat"
+last_modified_at: 2022-05-19
+toc: true
+toc_label: ""
+tags:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Splunk Behavioral Analytics
+ - Endpoint
+ - Exploitation
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-19
+- **Author**: Jose Hernandez, Splunk
+- **ID**: c633df29-a950-4c4c-a0f8-02be6730797c
+
+#### Narrative
+
+Insider Threats is best defined by CISA \"Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs.\" An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats.
+\* Departing Employees \* Security Evaders \* Malicious Insiders \* Negligent Employees
+This story aims at detecting the malicious insider.
+
+#### Detections
+
+| Name | Technique | Type |
+| ----------- | ----------- |--------------|
+| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service)| Anomaly |
+| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly |
+| [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account)| Anomaly |
+| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly |
+| [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly |
+
+#### Reference
+
+* [https://www.imperva.com/learn/application-security/insider-threats/](https://www.imperva.com/learn/application-security/insider-threats/)
+* [https://www.cisa.gov/defining-insider-threats](https://www.cisa.gov/defining-insider-threats)
+* [https://www.code42.com/glossary/types-of-insider-threats/](https://www.code42.com/glossary/types-of-insider-threats/)
+* [https://github.com/Insider-Threat/Insider-Threat](https://github.com/Insider-Threat/Insider-Threat)
+* [https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/](https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/insider_threat.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index e69d65efad..048722cb11 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -64,11 +64,11 @@ Most recently we have added new content related to PowerShell Script Block loggi
| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information)| TTP |
+| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses), [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
#### Reference
diff --git a/docs/index.markdown b/docs/index.markdown
index 0f7a3ec561..94a55d07c0 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -41,7 +41,7 @@ feature_row:
This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk SOAR playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺
Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique.
diff --git a/docs/mitre-map/coverage.png b/docs/mitre-map/coverage.png
index b816800247..60c18e4fd9 100644
Binary files a/docs/mitre-map/coverage.png and b/docs/mitre-map/coverage.png differ
diff --git a/stories/insider_threat.yml b/stories/insider_threat.yml
new file mode 100644
index 0000000000..342c99c023
--- /dev/null
+++ b/stories/insider_threat.yml
@@ -0,0 +1,39 @@
+name: Insider Threat
+id: c633df29-a950-4c4c-a0f8-02be6730797c
+version: 1
+date: '2022-05-19'
+author: Jose Hernandez, Splunk
+description: Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.
+narrative: Insider Threats is best defined by CISA \"Insider threat incidents are possible in any sector or organization.
+ An insider threat is typically a current or former employee, third-party contractor, or business partner.
+ In their present or former role, the person has or had access to an organization's network systems,
+ data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive,
+ prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs.\"
+ An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems.
+ These are the common insiders that create insider threats.
+
+ \* Departing Employees
+ \* Security Evaders
+ \* Malicious Insiders
+ \* Negligent Employees
+
+ This story aims at detecting the malicious insider.
+references:
+- https://www.imperva.com/learn/application-security/insider-threats/
+- https://www.cisa.gov/defining-insider-threats
+- https://www.code42.com/glossary/types-of-insider-threats/
+- https://github.com/Insider-Threat/Insider-Threat
+- https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/
+tags:
+ analytic_story: Insider Threat
+ category:
+ - Adversary Tactics
+ - Account Compromise
+ - Lateral Movement
+ - Privilege Escalation
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Splunk Behavioral Analytics
+ usecase: Advanced Threat Detection
\ No newline at end of file