RBA done

detections/endpoint/attempt_to_stop_security_service.yml

@@ -11,7 +11,7 @@ description: This search looks for attempts to stop security-related services on
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
-  stop *" Processes.dest Processes.user Processes.parent_process Processes.process_name
+  stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   |lookup security_services_lookup service as process OUTPUTNEW category, description

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -67,7 +67,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$.
+  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
   observable:
   - name: user
     type: User

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -68,7 +68,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$.
+  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
   observable:
   - name: user
     type: User

detections/endpoint/disabling_cmd_application.yml

@@ -46,3 +46,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows command prompt was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_controlpanel.yml

@@ -45,3 +45,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows Control Panel was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_firewall_with_netsh.yml

@@ -50,3 +50,20 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows Firewall was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -47,3 +47,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_net_user_account.yml

@@ -48,3 +48,28 @@ tags:
   - Processes.process_id
   - Processes.parent_process
   security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/disabling_norun_windows_app.yml

@@ -48,3 +48,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_remote_user_account_control.yml

@@ -51,3 +51,20 @@ tags:
   - Registry.user
   - Registry.action
   security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -48,3 +48,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows registry was modified to disable system restore on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/disabling_task_manager.yml

@@ -47,3 +47,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows Task Manager was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml

@@ -52,3 +52,28 @@ tags:
   - dest_port
   - process_path
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_image
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/dns_exfiltration_using_nslookup_app.yml

@@ -13,7 +13,7 @@ description: this search is to detect potential DNS exfiltration using nslookup
   commonly used by attacker and also the retry parameter which is designed to query
   C2 DNS multiple tries.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process
+  values(Processes.process_id) as process_id values(Processes.parent_process_name) as parent_process
   count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*"
   OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*"
@@ -50,8 +50,34 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
   - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/download_files_using_telegram.yml

@@ -47,3 +47,20 @@ tags:
   - TargetFilename
   - Hash
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Suspicious files were downloaded with the Telegram application on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/dsquery_domain_discovery.yml

@@ -59,8 +59,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.user
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -45,8 +45,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.user
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/dump_lsass_via_procdump.yml

@@ -54,8 +54,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.user
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/dump_lsass_via_procdump_rename.yml

@@ -58,3 +58,24 @@ tags:
   - Computer
   - parent_process_name
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -44,3 +44,20 @@ tags:
   - Registry.user
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: RDP was moved to a non-standard port on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/enumerate_users_local_group_using_telegram.yml

@@ -47,3 +47,20 @@ tags:
   - Security_ID
   - Message
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/eventvwr_uac_bypass.yml

@@ -49,3 +49,20 @@ tags:
   - Registry.dest
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/excel_spawning_powershell.yml

@@ -50,3 +50,28 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excel_spawning_windows_script_host.yml

@@ -54,3 +54,28 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excessive_attempt_to_disable_services.yml

@@ -47,3 +47,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml

@@ -45,3 +45,16 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml

@@ -55,3 +55,20 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excessive_number_of_taskhost_processes.yml

@@ -50,3 +50,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excessive_service_stop_attempt.yml

@@ -49,3 +49,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/excessive_usage_of_cacls_app.yml

@@ -47,3 +47,20 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process