diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 0723ca36de..3297eef179 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -11,7 +11,7 @@ description: This search looks for attempts to stop security-related services on search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* - stop *" Processes.dest Processes.user Processes.parent_process Processes.process_name + stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 53b9cfed39..708324c566 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -67,7 +67,7 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$. + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. observable: - name: user type: User diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 2fe92befd6..000e819ef7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -68,7 +68,7 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$. + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. observable: - name: user type: User diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 2fbb659e41..d7fe125702 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -46,3 +46,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows command prompt was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index d25066e65d..2c8d040d68 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -45,3 +45,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Control Panel was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 572993638b..117bb477f0 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -50,3 +50,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Firewall was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 25071310bb..51dbcccbc5 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -47,3 +47,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index ef36c58a14..3b29af2769 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -48,3 +48,28 @@ tags: - Processes.process_id - Processes.parent_process security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index a6d5beef11..0391ca5b8d 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -48,3 +48,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 7983188c01..ad255020e7 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -51,3 +51,20 @@ tags: - Registry.user - Registry.action security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 0de4f02151..edb1cbc28e 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -48,3 +48,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows registry was modified to disable system restore on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 35d551fed1..3776941ffd 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -47,3 +47,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Windows Task Manager was disabled on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 1aa342dae6..681ca72282 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -52,3 +52,28 @@ tags: - dest_port - process_path security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 0e2e70d158..ca62530c14 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -13,7 +13,7 @@ description: this search is to detect potential DNS exfiltration using nslookup commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process + values(Processes.process_id) as process_id values(Processes.parent_process_name) as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*" @@ -50,8 +50,34 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index da85779daf..728d3688e5 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -47,3 +47,20 @@ tags: - TargetFilename - Hash security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Suspicious files were downloaded with the Telegram application on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 349876a1bc..ac23e8ffc4 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -59,8 +59,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 94140f45e3..cfc859c177 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -45,8 +45,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 8a49c832ac..270489f8ac 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -54,8 +54,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index cf666556d2..cecfdad271 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -58,3 +58,24 @@ tags: - Computer - parent_process_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index a205a09ecf..d2b79306e6 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -44,3 +44,20 @@ tags: - Registry.user - Registry.registry_value_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: RDP was moved to a non-standard port on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 112b7e82c4..4b319cbdd0 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -47,3 +47,20 @@ tags: - Security_ID - Message security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 254a89981b..f2e28b5fde 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -49,3 +49,20 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index f6ad6b0b6f..2aa2661235 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -50,3 +50,28 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index ae6783ebf5..72aa0d85ee 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -54,3 +54,28 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 824acc3be4..88b5d1e174 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -47,3 +47,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 321c5b6a45..8b5e3e7a08 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -45,3 +45,16 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$. + observable: + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 932e6ea2d0..a0c1c000b2 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -55,3 +55,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 52a5537505..5a9edee5cf 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -50,3 +50,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 6517547594..4c861b9187 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -49,3 +49,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 4810bb92c0..cc5e031d21 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -47,3 +47,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file