From b21d754be3d2a88bbb1320f8db3c80039474a57d Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 20 Jul 2022 10:54:59 +0200 Subject: [PATCH 01/10] attack_data_helper --- .../factory/new_content_factory.py | 15 +++ .../factory/utils/new_content_questions.py | 84 +++++++++++++ .../application/use_cases/new_content.py | 12 +- .../domain/entities/enums/enums.py | 1 + .../adapter/obj_to_attackdata_yml_adapter.py | 112 ++++++++++++++++++ contentctl.py | 15 ++- 6 files changed, 234 insertions(+), 5 deletions(-) create mode 100644 bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py diff --git a/bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py b/bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py index bad3a9ce53..0d55641af7 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py @@ -91,3 +91,18 @@ class NewContentFactory(): self.output_dto.obj['tags']['category'] = answers['category'] self.output_dto.obj['tags']['product'] = ['Splunk Enterprise','Splunk Enterprise Security','Splunk Cloud'] self.output_dto.obj['tags']['usecase'] = answers['usecase'] + + + elif input_dto.type == SecurityContentType.attack_data: + questions = NewContentQuestions.get_questions_attack_data() + answers = questionary.prompt(questions) + self.output_dto.obj['author'] = answers['author_name'] + self.output_dto.obj['id'] = str(uuid.uuid4()) + self.output_dto.obj['date'] = datetime.today().strftime('%Y-%m-%d') + self.output_dto.obj['description'] = "description" + self.output_dto.obj['environment'] = "attackrange" + self.output_dto.obj['dataset'] = "datasets" + self.output_dto.obj['sourcetypes'] = answers['data_src_category'] + self.output_dto.obj['references'] = [answers['references']] + self.output_dto.obj['src_path'] = answers['src_file_path'].strip() + self.output_dto.obj['dst_path'] = answers['dest_file_path'].strip() diff --git a/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py b/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py index c8fd18d9ec..fa9be86912 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py +++ b/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py @@ -169,4 +169,88 @@ class NewContentQuestions(): ], }, ] + return questions + + + @classmethod + def get_questions_attack_data(self) -> list: + questions = [ + { + 'type': 'input', + 'message': 'enter the source file path of your attack_dataset (ex. ~/attack_range/attack_data/stext_sysmon/sysmon.log): ', + 'name': 'src_file_path', + }, + { + 'type': 'input', + 'message': 'enter the dest folder path for your attack_dataset (ex. ~/attack_data/datasets/malware/remcos/remcos_dynwrapx): ', + 'name': 'dest_file_path', + }, + { + 'type': 'input', + 'message': 'enter author name: ', + 'name': 'author_name', + 'default': 'STRT', + }, + { + 'type': 'checkbox', + 'message': 'select the data source type', + 'name': 'data_src_category', + 'choices': [ + { + 'name': 'windows-sysmon.log', + 'checked': True + }, + { + 'name': 'windows-security.log' + }, + { + 'name': 'windows-system.log' + }, + { + 'name': 'windows-powershell-xml.log' + }, + { + 'name': 'stream_http_events.log' + }, + { + 'name': 'aws_cloudtrail_events.json' + }, + { + 'name': 'o365_events.json' + }, + { + 'name': 'o365_exchange_events.json' + }, + { + 'name': 'kubernetes_events.json' + }, + { + 'name': 'security_hub_finding.json' + }, + { + 'name': 'gsuite_gmail_bigquery.json' + }, + { + 'name': 'gsuite_drive_json.json' + }, + { + 'name': 'github.json' + }, + { + 'name': 'kubernetes_nginx.json' + }, + { + 'name': 'circleci.json' + }, + { + 'name': 'sysmon_linux.log' + }, + ], + }, + { + 'type': 'input', + 'message': 'enter references: ', + 'name': 'references', + }, + ] return questions \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/new_content.py b/bin/contentctl_project/contentctl_core/application/use_cases/new_content.py index 1905d6554b..df2a70b0b0 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/new_content.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/new_content.py @@ -19,4 +19,14 @@ class NewContent: factory = NewContentFactory(factory_output_dto) factory.execute(input_dto.factory_input_dto) - input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type) \ No newline at end of file + input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type) + + +class NewAttackDataContent: + + def execute(self, input_dto: NewContentInputDto) -> None: + factory_output_dto = NewContentFactoryOutputDto(dict()) + factory = NewContentFactory(factory_output_dto) + factory.execute(input_dto.factory_input_dto) + + input_dto.adapter.writeObjects(factory_output_dto.obj, input_dto.factory_input_dto.type) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py index 6b68f5049b..742bf7b8e1 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py @@ -36,6 +36,7 @@ class SecurityContentType(enum.Enum): deployments = 7 investigations = 8 unit_tests = 9 + attack_data = 10 class SecurityContentProduct(enum.Enum): ESCU = 1 diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py new file mode 100644 index 0000000000..d1ce82ed96 --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py @@ -0,0 +1,112 @@ +import os +import re +from pathlib import Path +from bin.contentctl_project.contentctl_infrastructure.adapter.yml_writer import YmlWriter +from bin.contentctl_project.contentctl_core.application.adapter.adapter import Adapter +from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType +import shutil + +class ObjToAttackDataYmlAdapter(Adapter): + + def __init__(self): + self.ATTACK_DATASET_LINK = "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets" + self.sourcetype_dict = { + 'windows-sysmon.log':'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational', + 'windows-security.log': 'WinEventLog:Security', + 'windows-system.log': 'WinEventLog:system', + 'windows-powershell-xml.log' :'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational', + 'stream_http_events.log' :'stream:http', + 'aws_cloudtrail_events.json' :'aws:cloudtrail', + 'o365_events.json' :'o365:management:activity', + 'o365_exchange_events.json' :'o365:management:activity', + 'kubernetes_events.json' :'kubernetes', + 'security_hub_finding.json' :'aws:securityhub:finding', + 'gsuite_gmail_bigquery.json' :'gsuite:gmail:bigquery', + 'gsuite_drive_json.json':'gsuite:drive:json', + 'github.json' : 'aws:firehose:json', + 'kubernetes_nginx.json' :'kube:container:controller', + 'circleci.json' :'circleci', + 'sysmon_linux.log' :'Syslog:Linux-Sysmon/Operational' + } + return + + def banner(self): + print(""" + inspired from contentctl.py ... + running attack dataset utility helper. + warming up "Millenium Falcon"... + c==o + _/____\_ + _.,--'" ||^ || "`z._ + /_/^ ___\|| || _/o\ "`-._ + _/ ]. L_| || .|| \_/_ . _`--._ + /_~7 _ . " ||. || /] \ ]. (_) . "`--. + |__7~.(_)_ []|+--+|/____T_____________L| + |__| _^(_) /^ __\____e_ _| + |__| (_){_) J ]K{__ L___0_ _] + |__| . _(_) \v /__________|________ + l__l_ (_). []|+-+-<\^ L . _ - ---L| + \__\ __. ||^l \Y] /_] (_) . _,--' + \~_] L_| || .\ .\\/~. _,--'" + \_\ . __/|| |\ \`-+-<'" + "`---._|J__L|X o~~|[\\ + -Row \____/ \___|[// + `--' `--+-' + """) + + def expand_path(self, in_path: str) -> str: + if "~" in in_path: + return str(in_path).replace("~", str(Path.home())) + else: + return in_path + + + def extract_base_path(self, in_path: str) -> str: + return os.path.basename(os.path.normpath(self.expand_path(in_path))) + + + def gen_attack_data_descp(self, in_path: str) -> str: + descp = "Generated datasets for {} in attack range.".format(self.extract_base_path(self.expand_path(in_path)).replace("_"," ")) + return descp + + + def writeObjects(self, objects: list, output_path: str, type: SecurityContentType = None) -> None: + + ## check if src_path exist + expanded_src_path = self.expand_path(objects['src_path']) + expanded_dst_path = self.expand_path(objects['dst_path']) + try: + st = os.stat(expanded_src_path) + except os.error: + print("[x] ERROR: File {0} is not exist".format(objects['src_path'])) + exit() + + ## check if dest_path exist + if not os.path.isdir(expanded_dst_path): + os.makedirs(expanded_dst_path, exist_ok=True) + + objects['description'] = self.gen_attack_data_descp(objects['dst_path']) + + objects['dataset'] = [self.ATTACK_DATASET_LINK + objects['dst_path'].split("datasets")[1] + os.sep + self.extract_base_path(objects['src_path'])] + + objects['sourcetypes'] = [self.sourcetype_dict[objects['sourcetypes'][0]]] + + attack_data_yml_file = expanded_dst_path + os.sep + self.extract_base_path(objects['dst_path']).replace(" ", "_") + ".yml" + + ## copy the dataset to the destination folder + shutil.copy(expanded_src_path, expanded_dst_path) + + objects.pop('src_path') + + objects.pop('dst_path') + + YmlWriter.writeYmlFile(attack_data_yml_file, objects) + + ## read attackdata file + with open(attack_data_yml_file, 'r') as f: + self.banner() + print("[+] ----------- generated attack data yml file ------------\n") + print(f.read()) + + + diff --git a/contentctl.py b/contentctl.py index 5b79db40f8..bdabfa99ff 100644 --- a/contentctl.py +++ b/contentctl.py @@ -10,7 +10,7 @@ from bin.contentctl_project.contentctl_core.application.use_cases.content_change from bin.contentctl_project.contentctl_core.application.use_cases.generate import GenerateInputDto, Generate from bin.contentctl_project.contentctl_core.application.use_cases.validate import ValidateInputDto, Validate from bin.contentctl_project.contentctl_core.application.use_cases.doc_gen import DocGenInputDto, DocGen -from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent +from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent, NewAttackDataContent from bin.contentctl_project.contentctl_core.application.use_cases.reporting import ReportingInputDto, Reporting from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryInputDto from bin.contentctl_project.contentctl_core.application.factory.ba_factory import BAFactoryInputDto @@ -33,7 +33,7 @@ from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_svg_adapter from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attack_nav_adapter import ObjToAttackNavAdapter from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType - +from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attackdata_yml_adapter import ObjToAttackDataYmlAdapter def init(): @@ -238,13 +238,19 @@ def new_content(args) -> None: contentType = SecurityContentType.detections elif args.type == 'story': contentType = SecurityContentType.stories + elif args.type == 'attack_data': + contentType = SecurityContentType.attack_data else: print("ERROR: type " + args.type + " not supported") sys.exit(1) new_content_factory_input_dto = NewContentFactoryInputDto(contentType) - new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter()) - new_content = NewContent() + if args.type == 'attack_data': + new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToAttackDataYmlAdapter()) + new_content = NewAttackDataContent() + else: + new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter()) + new_content = NewContent() new_content.execute(new_content_input_dto) @@ -296,6 +302,7 @@ def main(args): new_content_parser = actions_parser.add_parser("new_content", help="Create new security content object") reporting_parser = actions_parser.add_parser("reporting", help="Create security content reporting") + # # new arguments From f5a53d0a646a513dfb890a594be6ed942271187c Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 28 Jul 2022 13:48:29 -0400 Subject: [PATCH 02/10] fixing base on feedback from users --- .../monitor_dns_for_brand_abuse.yml | 2 +- dist/escu/default/commands.conf | 7 ++--- dist/escu/default/searchbnf.conf | 26 ------------------- 3 files changed, 5 insertions(+), 30 deletions(-) delete mode 100644 dist/escu/default/searchbnf.conf diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index a23e13a57f..12fb70bec6 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -17,7 +17,7 @@ how_to_implement: You need to ingest data from your DNS logs. Specifically you m This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that - will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303) custom command. + will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1) custom command. known_false_positives: None at this time references: [] tags: diff --git a/dist/escu/default/commands.conf b/dist/escu/default/commands.conf index 14ea427b91..ad3cbfdfd0 100644 --- a/dist/escu/default/commands.conf +++ b/dist/escu/default/commands.conf @@ -1,6 +1,7 @@ -[dnstwist] -filename = dnstwist.py -chunked = true +# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1 +#[dnstwist] +#filename = dnstwist.py +#chunked = true # run story functionality has been moved to: https://github.com/splunk/analytic_story_execution' # [runstory] diff --git a/dist/escu/default/searchbnf.conf b/dist/escu/default/searchbnf.conf deleted file mode 100644 index 2b074fb3fe..0000000000 --- a/dist/escu/default/searchbnf.conf +++ /dev/null @@ -1,26 +0,0 @@ -[dnstwist-command] -syntax = dnstwist ()* -shortdesc = Perform word permutations on a domain, or list of domains -description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups -usage = public -maintainer = Splunk Security Research -example1 = |dnstwist domainlist=domains.csv -comment1 = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv -example2 = |dnstwist domain=www.splunk.com -comment2 = Performs word premutation on a single domain -example3 = |dnstwist populate_from_cim=true -comment3 = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM - -[dnstwist-options] -syntax = domainlist= | domain= | populate_from_cim= -description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of. - -# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution -# [runstory-command] -# syntax = runstory -# shortdesc = Run an analytic story -# description = Run all the detection searches in an analytic story -# maintainer = Splunk Security Research -# example1 = | runstory "Malicious PowerShell" -# example2 = | runstory "AWS Cryptomining" -# usage = public From bcb943d150845a521187f64d6f66d08737160c09 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 1 Aug 2022 11:31:23 +0200 Subject: [PATCH 03/10] fix tests --- .../tests/adapter/data/default/analyticstories.conf | 2 +- .../tests/adapter/data/default_reference/analyticstories.conf | 2 +- .../tests/adapter/data/lookups/security_services.csv | 2 +- .../tests/adapter/obj_to_json_adapter_data/baselines.json | 2 +- .../tests/adapter/obj_to_json_adapter_data/baselines_ref.json | 2 +- .../tests/adapter/obj_to_json_adapter_data/detections.json | 2 +- .../tests/adapter/obj_to_json_adapter_data/response_tasks.json | 2 +- .../adapter/obj_to_json_adapter_data/response_tasks_ref.json | 2 +- .../tests/adapter/obj_to_json_adapter_data/stories.json | 2 +- .../adapter/obj_to_md_data/_stories/darkside_ransomware.md | 2 +- .../adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf index 5d1de1ec59..94d9daaf6a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf @@ -35,7 +35,7 @@ providing_technologies = [] category = Malware last_updated = 2021-05-12 version = 1 -references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] +references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Get Parent Process Info - Response Task"] diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf index 5d1de1ec59..94d9daaf6a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf @@ -35,7 +35,7 @@ providing_technologies = [] category = Malware last_updated = 2021-05-12 version = 1 -references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] +references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Get Parent Process Info - Response Task"] diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/security_services.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/security_services.csv index bfbac66fb0..b8982c6109 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/security_services.csv +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/security_services.csv @@ -1,5 +1,5 @@ service,description,category *mpssvc*,Windows Firewall Service,security -*wscsvc*,Windows Security Center Service,securty +*wscsvc*,Windows Security Center Service,security *windefend*,Windows Defender Service,security *sysmon*,Sysmon Driver,security diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json index aa656a9850..fff623f0ad 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json @@ -1 +1 @@ -{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file +{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json index aa656a9850..fff623f0ad 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json @@ -1 +1 @@ -{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file +{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json index 3598427247..4eaaaa42cb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json @@ -1 +1 @@ -{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/jhernandez/splunk/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]} \ No newline at end of file +{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/p4t12ick/projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json index 78631ceb29..676e93489a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json @@ -1 +1 @@ -{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file +{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json index 78631ceb29..676e93489a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json @@ -1 +1 @@ -{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file +{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index b3c6439f68..0f76adfa16 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -1 +1 @@ -{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]} \ No newline at end of file +{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md index 3cb7373f9b..8140e824f9 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md @@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil #### Reference * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/) -* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) +* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md index 3cb7373f9b..8140e824f9 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md @@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil #### Reference * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/) -* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) +* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations) From c71b04a866fd01b480c3b4febf61f406a0218be2 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 1 Aug 2022 18:43:39 +0000 Subject: [PATCH 04/10] Updated detection files with recommended TA list. --- ...e_created_with_previously_unseen_image.yml | 2 - ...d_with_previously_unseen_instance_type.yml | 2 - .../active_setup_registry_autostart.yml | 4 +- ...ound_traffic_by_firewall_rule_registry.yml | 30 +- .../change_default_file_association.yml | 4 +- .../disable_amsi_through_registry.yml | 2 - .../disable_defender_antivirus_registry.yml | 2 - ...able_defender_blockatfirstseen_feature.yml | 2 - ...disable_defender_enhanced_notification.yml | 2 - .../disable_defender_mpengine_registry.yml | 2 - .../disable_defender_spynet_reporting.yml | 2 - ...efender_submit_samples_consent_feature.yml | 2 - .../endpoint/disable_etw_through_registry.yml | 2 - detections/endpoint/disable_registry_tool.yml | 2 - ...le_security_logs_using_minint_registry.yml | 2 - .../disable_uac_remote_restriction.yml | 2 - .../disable_windows_behavior_monitoring.yml | 2 - .../endpoint/disabling_cmd_application.yml | 2 - .../endpoint/disabling_controlpanel.yml | 2 - .../endpoint/disabling_defender_services.yml | 2 - .../endpoint/disabling_norun_windows_app.yml | 2 - .../disabling_systemrestore_in_registry.yml | 2 - .../endpoint/disabling_task_manager.yml | 2 - .../enable_rdp_in_other_port_number.yml | 2 - ...le_wdigest_uselogoncredential_registry.yml | 2 - detections/endpoint/etw_registry_disabled.yml | 4 +- detections/endpoint/eventvwr_uac_bypass.yml | 2 - ..._or_script_creation_in_suspicious_path.yml | 4 +- .../logon_script_event_trigger_execution.yml | 4 +- ...z_passtheticket_commandline_parameters.yml | 2 + .../msmpeng_application_dll_side_loading.yml | 2 - .../registry_keys_used_for_persistence.yml | 16 +- .../remcos_client_registry_install_entry.yml | 2 - detections/endpoint/revil_registry_entry.yml | 2 - .../rubeus_command_line_parameters.yml | 2 + .../endpoint/rundll32_lockworkstation.yml | 4 +- .../rundll_loading_dll_by_ordinal.yml | 2 + .../endpoint/ryuk_test_files_detected.yml | 2 + .../screensaver_event_trigger_execution.yml | 4 +- .../endpoint/shim_database_file_creation.yml | 4 +- ..._windows_rundll32_inline_hta_execution.yml | 2 - ...spicious_writes_to_windows_recycle_bin.yml | 4 +- .../time_provider_persistence_registry.yml | 4 +- ...roxy_execution_mavinject_dll_injection.yml | 51 +- ...ipting_interpreter_path_traversal_exec.yml | 37 +- ...s_command_shell_dcrat_forkbomb_payload.yml | 35 +- ...dows_defender_exclusion_registry_entry.yml | 2 - ...k_workstation_feature_through_registry.yml | 36 +- ...disable_logoff_button_through_registry.yml | 65 +- ...sable_shutdown_button_through_registry.yml | 45 +- ...group_policy_features_through_registry.yml | 42 +- .../windows_disableantispyware_reg.yml | 2 - ...s_execute_arbitrary_commands_with_msdt.yml | 53 +- ...notification_features_through_registry.yml | 45 +- ...e_delete_win_defender_profile_registry.yml | 23 +- ..._deny_security_software_with_applocker.yml | 39 +- ...nses_disable_win_defender_auto_logging.yml | 27 +- ...ndirect_command_execution_via_forfiles.yml | 49 +- ..._indirect_command_execution_via_pcalua.yml | 50 +- ...ify_registry_regedit_silent_reg_import.yml | 36 +- ...w_compress_color_and_info_tip_registry.yml | 2 + ..._mof_event_triggered_execution_via_wmi.yml | 60 +- .../windows_msiexec_dllregisterserver.yml | 43 +- .../windows_msiexec_remote_download.yml | 45 +- ...indows_msiexec_spawn_discovery_command.yml | 44 +- ...s_msiexec_unregister_dllregisterserver.yml | 40 +- .../endpoint/windows_odbcconf_load_dll.yml | 39 +- .../windows_odbcconf_load_response_file.yml | 39 +- .../windows_office_product_spawning_msdt.yml | 52 +- ...ows_process_with_namedpipe_commandline.yml | 2 + ...ocesses_killed_by_industroyer2_malware.yml | 23 +- .../windows_rasautou_dll_execution.yml | 2 + .../windows_registry_delete_task_sd.yml | 41 +- ...ows_remote_assistance_spawning_process.yml | 2 + ...remote_service_rdpwinst_tool_execution.yml | 30 +- ..._remote_services_allow_rdp_in_firewall.yml | 26 +- .../windows_schtasks_create_run_as_system.yml | 2 + ...ndows_security_account_manager_stopped.yml | 4 +- ...dows_service_create_kernel_mode_driver.yml | 34 +- .../windows_service_stop_by_deletion.yml | 16 +- .../windows_system_logoff_commandline.yml | 28 +- .../windows_system_reboot_commandline.yml | 30 +- .../windows_system_shutdown_commandline.yml | 28 +- ...dows_system_time_discovery_w32tm_delay.yml | 31 +- ...id_account_with_never_expires_password.yml | 30 +- ...g4shell_jndi_payload_injection_attempt.yml | 2 + .../web/spring4shell_payload_url_request.yml | 27 +- detections/web/web_jsp_request_via_url.yml | 32 +- .../detection_ta_mapping.csv | 708 ++++--- .../detection_ta_mapping.yml | 1840 +++++++++++------ 90 files changed, 2395 insertions(+), 1692 deletions(-) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 0b9e44dd38..eaa69b3371 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -69,5 +69,3 @@ tags: - All_Changes.user risk_score: 36 security_domain: threat - supported_tas: - - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index bdc4b42232..69d089c8c1 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -69,5 +69,3 @@ tags: - All_Changes.user risk_score: 30 security_domain: threat - supported_tas: - - Splunk_TA_aws-kinesis-firehose diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 824682c8f9..839bf47dd3 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -40,7 +40,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 80 context: - Source:Endpoint @@ -76,6 +76,4 @@ tags: - Registry.registry_value_name risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index e4601941bf..8fbd9c0f4b 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -13,18 +13,18 @@ description: This analytic detects a potential suspicious modification of firewa search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = - "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name - | `allow_inbound_traffic_by_firewall_rule_registry_filter`' + "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest + Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid + Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | fields _time dest user parent_process_name parent_process process_name + process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name] | table _time dest user parent_process_name parent_process process_name + process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -48,8 +48,8 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Suspicious firewall allow rule modifications were detected via the registry on endpoint - $dest$ by user $user$. + message: Suspicious firewall allow rule modifications were detected via the registry + on endpoint $dest$ by user $user$. mitre_attack_id: - T1021.001 - T1021 @@ -77,6 +77,4 @@ tags: - Registry.user risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 34c1cdecce..59e0e60ef8 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -31,7 +31,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -67,6 +67,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 7002c61662..d5a0409e7c 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -64,8 +64,6 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4aace03422..4508894ffc 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 67493e64e5..0d0c0f0518 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 51543a90d4..c0a2da5e5f 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 15558e4857..e615625cef 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index d50493ac2d..fdf6f86f27 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index dc17013676..e6444b3401 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index bd0cb4a173..34708edcd8 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -63,8 +63,6 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index f103d447f3..60016c024f 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index cfe318454b..0c268b1755 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 7274da1be8..5f36ad8bfb 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -74,6 +74,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 7a3bca8c50..36e847bd62 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -76,6 +76,4 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6ea9d3374a..9006a4e342 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -72,6 +72,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 1784fcf94e..fb73ca5935 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 9194625692..8d7c5fc76e 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -72,6 +72,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index dd31cbbe30..d1bcc23391 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 552d04ef06..4f2d135f99 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 3c65b3339d..1fedab8198 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -73,6 +73,4 @@ tags: - Registry.registry_value_name risk_score: 42 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 897386f6a7..966883bf51 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 828b657127..11264a30e1 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 56af0e84d8..d613e31276 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -38,7 +38,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -76,6 +76,4 @@ tags: - Registry.registry_value_data risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 691b33b0c9..57dcf8d724 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -79,6 +79,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index d7909ae2a3..88a9dcb2c6 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -35,7 +35,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Double Zero Destructor + - Double Zero Destructor - Data Destruction - XMRig - Remcos @@ -85,6 +85,4 @@ tags: - Filesystem.user risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index c2789af5d0..18c924a758 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -64,6 +64,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index b7bd73fc7f..26fe1e9e44 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process_name risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 043e3410ed..a5b5b822a9 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -55,8 +55,6 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index a9047c9439..d2c3184285 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -9,8 +9,7 @@ datamodel: description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry - where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce + as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* @@ -24,13 +23,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" - AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.registry_key_name - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `registry_keys_used_for_persistence_filter`' + AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data Registry.process_guid + Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -95,5 +91,3 @@ tags: - Registry.user risk_score: 76 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5028c90de0..af7fb3ca92 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -62,6 +62,4 @@ tags: - Registry.user risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index e0ae661df2..f67169a505 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_key_name risk_score: 60 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 6e99edde4c..467f1a88c0 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_name risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 3a596146e7..8aabdc6b74 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -65,4 +65,6 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 2c40265a4a..93d17df1aa 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index fbe835cad6..49a3d29e92 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -59,3 +59,5 @@ tags: - Filesystem.user risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index b32d2605da..743596ddef 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -32,7 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 90 context: - Source:Endpoint @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 72 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 4803568843..ecd3170a71 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -4,7 +4,7 @@ version: 3 date: '2020-12-08' author: David Dorsey, Splunk type: TTP -datamodel: +datamodel: - Endpoint description: This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According @@ -66,3 +66,5 @@ tags: - Filesystem.dest risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 1ba358eda6..40df19bf94 100644 --- a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -94,5 +94,3 @@ tags: - cmd_line risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index a9e4bad569..1c607c6d10 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -4,7 +4,7 @@ version: 4 date: '2020-07-22' author: Rico Valdez, Splunk type: TTP -datamodel: +datamodel: - Endpoint description: This search detects writes to the recycle bin by a process other than explorer.exe. @@ -70,3 +70,5 @@ tags: security_domain: endpoint kill_chain_phases: - Exploitation + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 44b59e6cc7..094d60fcf0 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -39,7 +39,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index dd84570d4d..bfb7e2c234 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -6,23 +6,31 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). - In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. - During triage, review file modifcations and parallel processes. +description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running + processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution + (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition + to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import + descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe + PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an + import table entry consisting of the specified DLL into the module at the given + base address. During triage, review file modifcations and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_binary_proxy_execution_mavinject_dll_injection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter on DLL name or parent process. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe + Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter on DLL name or parent + process. references: - - https://attack.mitre.org/techniques/T1218/013/ - - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process +- https://attack.mitre.org/techniques/T1218/013/ +- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process tags: analytic_story: - Living Off The Land @@ -40,7 +48,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting load a DLL. mitre_attack_id: - T1218.013 - T1218 @@ -71,14 +80,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index f084d38485..4ec1787e7f 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line - that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +description: The following analytic identifies path traversal command-line execution. + This technique was seen in malicious document that execute malicious code using + msdt.exe and path traversal technique that serve as defense evasion. This TTP is + a good pivot to look for more suspicious process and command-line that runs before + and after this execution. This may help you to find possible downloaded malware + or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" + OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id + Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product -known_false_positives: Not known at this moment. +known_false_positives: Not known at this moment. references: - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ tags: @@ -43,7 +45,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + message: A parent process $parent_process_name$ has spawned a child $process_name$ + with path traversal commandline $process$ in $dest$ mitre_attack_id: - T1059 nist: @@ -61,14 +64,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 0616c2a06c..d6580aab96 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -6,19 +6,23 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies DCRat "forkbomb" payload feature. - This technique was seen in dark crystal RAT backdoor capabilities where it will execute several cmd child process - executing "notepad.exe & pause". This analytic detects the multiple cmd.exe and child process notepad.exe execution using batch script - in the targeted host within 30s timeframe. this TTP can be a good pivot to check DCRat infection. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.parent_process_id) as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= "notepad.exe") Processes.parent_process = "*.bat*" - by Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest Processes.user _time - span=30s | where parent_process_id_count>= 10 AND process_id_count >=10 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_command_shell_dcrat_forkbomb_payload_filter`' +description: The following analytic identifies DCRat "forkbomb" payload feature. This + technique was seen in dark crystal RAT backdoor capabilities where it will execute + several cmd child process executing "notepad.exe & pause". This analytic detects + the multiple cmd.exe and child process notepad.exe execution using batch script + in the targeted host within 30s timeframe. this TTP can be a good pivot to check + DCRat infection. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.parent_process_id) + as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) + as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) + as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name= + "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= + "notepad.exe") Processes.parent_process = "*.bat*" by Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest + Processes.user _time span=30s | where parent_process_id_count>= 10 AND process_id_count + >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -45,7 +49,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: Multiple cmd.exe processes with child process of notepad.exe executed on $dest$ + message: Multiple cmd.exe processes with child process of notepad.exe executed on + $dest$ mitre_attack_id: - T1059.003 - T1059 @@ -75,3 +80,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index aff252f197..e0d6415762 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_data risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index eaf42461b5..4e4eff11f6 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -6,13 +6,15 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. - This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. - This technique was used by threat actor to make its payload more impactful to the compromised host. +description: This analytic is to detect a suspicious registry modification to disable + Lock Computer windows features. This registry modification prevent the user from + locking its screen or computer that are being abused by several malware for example + ransomware. This technique was used by threat actor to make its payload more impactful + to the compromised host. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -21,15 +23,14 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_lock_workstation_feature_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ -- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ +- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ +- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ tags: analytic_story: - Ransomware @@ -51,17 +52,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +78,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 1d42ed5b62..0e9dbda9bf 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -6,33 +6,35 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. - This registry when enable will prevent users to log off of the system by using any method, - including programs run from the command line, such as scripts. It also disables or removes - all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware - to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +description: This analytic is to detect a suspicious registry modification to disable + logoff feature in windows host. This registry when enable will prevent users to + log off of the system by using any method, including programs run from the command + line, such as scripts. It also disables or removes all menu items and buttons that + log the user off of the system. This technique was seen abused by ransomware malware + to make the compromised host un-useful and hard to remove other registry modification + made on the machine that needs restart to take effect. This windows feature may + implement by administrator in some server where shutdown is critical. In that scenario + filter of machine and users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_logoff_button_through_registry_filter`' + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data + = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, + _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_guid | + `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name + parent_process process_name process_path process proc_guid registry_path registry_value_name + registry_value_data | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp @@ -57,17 +59,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -84,4 +85,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 835040e6b0..ed35c9bdca 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. - This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host - un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +description: This analytic is to detect a suspicious registry modification to disable + shutdown button on the logon user. This technique was seen in several malware especially + in ransomware family like killdisk malware variant to make the compromised host + un-useful and hard to remove other registry modification made on the machine that + needs restart to take effect. This windows feature may implement by administrator + in some server where shutdown is critical. In that scenario filter of machine and + users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" - Registry.registry_value_data = "0x00000000") - OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" + Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,15 +26,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_shutdown_button_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ tags: analytic_story: - Ransomware @@ -53,17 +55,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -80,4 +81,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index ac3844dbc3..5cf39e490b 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable windows features. - These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response - from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but - can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed. +description: This analytic is to detect a suspicious registry modification to disable + windows features. These techniques are seen in several ransomware malware to impair + the compromised host to make it hard for analyst to mitigate or response from the + attack. Disabling these known features make the analysis and forensic response more + hard. Disabling these feature is not so common but can still be implemented by the + administrator for security purposes. In this scenario filters for users that are + allowed doing this is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" - Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", - "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" + Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", + "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,8 +28,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_windows_group_policy_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. @@ -55,17 +58,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -82,4 +84,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 5fd40bf090..798cd03532 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -69,5 +69,3 @@ tags: - Registry.registry_path risk_score: 24 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index d0441635f1..e21da68094 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -6,24 +6,33 @@ author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. - During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +description: The following analytic identifies a recently disclosed arbitraty command + execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample + identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve + a remote payload. During triage, review file modifications for html. Identify parallel + process execution that may be related, including an Office Product. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe - Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. + Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") + AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" + OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter as needed. Added .xml + to potentially capture any answer file usage. Remove as needed. references: - - https://isc.sans.edu/diary/rss/28694 - - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A - - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection - - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: analytic_story: - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 @@ -43,8 +52,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: A parent process $parent_process_name$ has spawned a child - process $process_name$ on host $dest$ possibly indicative of indirect command execution. + message: A parent process $parent_process_name$ has spawned a child process $process_name$ + on host $dest$ possibly indicative of indirect command execution. mitre_attack_id: - T1218 nist: @@ -74,14 +83,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 100 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6f5e2c783a..8952b7a5ad 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -6,30 +6,32 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. - This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and - ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed. +description: This analytic is to detect a suspicious registry modification to hide + common windows notification feature from compromised host. This technique was seen + in some ransomware family to add more impact to its payload that are visually seen + by user aside from the encrypted files and ransomware notes. Even this a good anomaly + detection, administrator may implement this changes for auditing or security reason. + In this scenario filter is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", + "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by + _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_hide_notification_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ tags: analytic_story: - Ransomware @@ -51,17 +53,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +79,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index c8f7a347bd..7dfa1be2f0 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The search looks for the deletion of Windows Defender main profile within the registry. - This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple +description: The search looks for the deletion of Windows Defender main profile within + the registry. This was used by RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an adversary gains access to an endpoint and + beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_impair_defense_delete_win_defender_profile_registry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows + Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.user + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -71,5 +70,3 @@ tags: - Registry.action risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml index c26cd774cb..8ca83b8fc5 100644 --- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml @@ -7,24 +7,28 @@ type: TTP datamodel: - Endpoint description: The following analytic identifies a modification in the Windows registry - by the Applocker utility that contains details or registry data values related to denying the execution of several security products. - This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker - commandlet. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") - OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" - AND Registry.registry_value_data = "*Action\=\"Deny\"*" - AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") - by Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + by the Applocker utility that contains details or registry data values related to + denying the execution of several security products. This technique was seen in Azorult + malware where it drops an xml Applocker policy that will deny several AV products + and then loaded by using PowerShell Applocker commandlet. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group + Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") + OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND + Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data + IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA + SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", + "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", + "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.user Registry.registry_path + Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: False positives may be present based on organization use of Applocker. Filter as needed. +known_false_positives: False positives may be present based on organization use of + Applocker. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11 @@ -45,9 +49,10 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: Applocker registry modification to deny the action of several AV products on $dest$. + message: Applocker registry modification to deny the action of several AV products + on $dest$. mitre_attack_id: - - T1562.001 + - T1562.001 - T1562 nist: - DE.CM @@ -74,4 +79,6 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index ec4d4bf177..f13ee9a841 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. - This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' +description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger + set to disable. This is consistent with RAT malware across a fleet of endpoints. + This particular behavior is typically executed when an adversary gains access to + an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed + and multiple registry and scheduled task modifications will occur. During triage, + review parallel processes and identify any further file modifications. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" + OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data + ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -71,5 +70,3 @@ tags: - Registry.action risk_score: 24 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 557b7b6812..10eaec97a3 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -7,25 +7,25 @@ type: TTP datamodel: - Endpoint description: The following analytic detects programs that have been started by forfiles.exe. - According to Microsoft, the 'The forfiles command lets you run a command on or pass + According to Microsoft, the 'The forfiles command lets you run a command on or pass arguments to multiple files'. While this tool can be used to start legitimate programs, - usually within the context of a batch script, it has been observed being used to evade - protections on command line execution. + usually within the context of a batch script, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_forfiles_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* + /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where forfiles.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. - Similarly, forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, + forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles tags: analytic_story: - Living Off The Land @@ -43,21 +43,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -70,5 +69,7 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 6e29b08e87..e89f30e86d 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -6,24 +6,25 @@ author: Eric McGinnis, Splunk type: TTP datamodel: - Endpoint -description: The following analytic detects programs that have been started by pcalua.exe. - pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this tool - can be used to start legitimate programs, it has been observed being used to evade - protections on command line execution. +description: The following analytic detects programs that have been started by pcalua.exe. + pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this + tool can be used to start legitimate programs, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_pcalua_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* + -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where pcalua.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Filter + these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ tags: analytic_story: - Living Off The Land @@ -41,21 +42,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -68,5 +68,7 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index c4d436842c..ad7bf050af 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -6,24 +6,27 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies modification of Windows registry - using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. - This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with - dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") - AND Processes.process="* /s *" AND Processes.process="*.reg*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_modify_registry_regedit_silent_reg_import_filter`' +description: The following analytic identifies modification of Windows registry using + regedit.exe application with silent mode parameter. regedit.exe windows application + is commonly used as GUI app to check or modify registry. This application is also + has undocumented command-line parameter and one of those are silent mode parameter + that performs action without stopping for confirmation with dialog box. Importing + registry from .reg files need to monitor in a production environment since it can + be used adversaries to import RMS registry in compromised host. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") + AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed. +known_false_positives: Administrators may execute this command that may cause some + false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe @@ -44,7 +47,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: The regedit app was executed with silet mode parameter to import .reg file on $dest$. + message: The regedit app was executed with silet mode parameter to import .reg file + on $dest$. mitre_attack_id: - T1112 nist: @@ -72,4 +76,6 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index c7538027c5..25a12aebf3 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -74,3 +74,5 @@ tags: risk_score: 25 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index d8d851af0f..2d5c418378 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -6,27 +6,34 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. - Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. - A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. - The default path of mofcomp.exe is C:\Windows\System32\wbem. +description: The following anaytic identifies MOFComp.exe loading a MOF file. The + Managed Object Format (MOF) compiler parses a file containing MOF statements and + adds the classes and class instances defined in the file to the WMI repository. + Typically, MOFComp.exe does not reach out to the public internet or load a MOF file + from User Profile paths. A filter and consumer is typically registered in WMI. Review + parallel processes and query WMI subscriptions to gather artifacts. The default + path of mofcomp.exe is C:\Windows\System32\wbem. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where - (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) - OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_mof_event_triggered_execution_via_wmi_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe + Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present from automation based applications + (SCCM), filtering may be required. In addition, break the query out based on volume + of usage. Filter process names or f references: - - https://attack.mitre.org/techniques/T1546/003/ - - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - - https://www.sakshamdixit.com/wmi-events/ +- https://attack.mitre.org/techniques/T1546/003/ +- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp +- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ +- https://www.sakshamdixit.com/wmi-events/ tags: analytic_story: - Living Off The Land @@ -44,7 +51,8 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ loading a MOF file. mitre_attack_id: - T1546.003 nist: @@ -74,14 +82,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 64 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index a928508c8f..560e7ef49a 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -6,21 +6,25 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. +description: The following analytic identifies the usage of msiexec.exe using the + /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` - Processes.process IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_msiexec_dllregisterserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based + on legitimate usage of msiexec.exe. Filter as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -38,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to register a file. mitre_attack_id: - T1218.007 nist: @@ -68,14 +73,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 69ba719e45..f356f4fbf1 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -6,21 +6,25 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. - During triage, review parallel processes and capture any artifacts on disk for review. +description: The following analytic identifies msiexec.exe with http in the command-line. + This procedure will utilize msiexec.exe to download a remote file and load it. During + triage, review parallel processes and capture any artifacts on disk for review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_msiexec_remote_download_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter by destination or parent process as needed. + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*http://*", "*https://*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter by destination or parent + process as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -38,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a remote file. mitre_attack_id: - T1218.007 nist: @@ -68,14 +73,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index 2d34188916..759dcf366a 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -6,20 +6,27 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies MSIExec spawning multiple discovery commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes are not common from MSIExec other than MSIExec spawning itself. +description: The following analytic identifies MSIExec spawning multiple discovery + commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes + are not common from MSIExec other than MSIExec spawning itself. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe + Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_discovery_command_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives will be present with MSIExec spawning Cmd or + PowerShell. Filtering will be needed. In addition, add other known discovery processes + to enhance query. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -37,7 +44,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ running different discovery commands. mitre_attack_id: - T1218.007 nist: @@ -67,14 +75,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 594212f96d..2aafffa8c5 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -6,20 +6,25 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. +description: The following analytic identifies the usage of msiexec.exe using the + /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` - Processes.process IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based + on legitimate usage of msiexec.exe. Filter as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -37,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to unregister a file. mitre_attack_id: - T1218.007 nist: @@ -67,14 +73,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index ae7b78d362..8a959c4378 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -6,19 +6,23 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. - An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. - During triage, review parent process, parallel procesess and file modifications. +description: The following analytic identifies odbcconf.exe, Windows Open Database + Connectivity utility, utilizing the action function of regsvr to load a DLL. An + example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, + review parent process, parallel procesess and file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_odbcconf_load_dll_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. + Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering may need to occur + based on legitimate application usage. Filter as needed. references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw @@ -43,7 +47,8 @@ tags: - T1218.008 nist: - DE.CM - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to circumvent controls. observable: - name: user type: User @@ -69,14 +74,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 74d58ef9f2..64dd03fd1f 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -6,18 +6,24 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. +description: The following analytic identifies the odbcconf.exe, Windows Open Database + Connectivity utility, loading up a resource file. The file extension is arbitrary + and may be named anything. The resource file itself may have different commands + supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. + During triage, review file modifications and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_odbcconf_load_response_file_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. + Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering may need to occur + based on legitimate application usage. Filter as needed. references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw @@ -42,7 +48,8 @@ tags: - T1218.008 nist: - DE.CM - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to circumvent controls. observable: - name: user type: User @@ -68,14 +75,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index fe9ec16b7a..d6a27dfdda 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -6,24 +6,32 @@ author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. - During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +description: The following analytic identifies a Microsoft Office product spawning + the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native + to Windows. This behavior is related to a recently identified sample utilizing protocol + handlers to evade preventative controls, including if macros are disabled in the + document. During triage, review file modifications for html. In addition, parallel + processes including PowerShell and CertUtil. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `windows_office_product_spawning_msdt_filter`' -how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") + Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`' +how_to_implement: how To successfully implement this search you need to be ingesting + information on process that include the name of the process responsible for the + changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. known_false_positives: False positives should be limited, however filter as needed. references: - - https://isc.sans.edu/diary/rss/28694 - - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A - - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection - - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: analytic_story: - Spearphishing Attachments @@ -44,8 +52,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: Office parent process $parent_process_name$ has spawned a child - process $process_name$ on host $dest$. + message: Office parent process $parent_process_name$ has spawned a child process + $process_name$ on host $dest$. mitre_attack_id: - T1566 - T1566.001 @@ -76,14 +84,16 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 8d08e15fbd..8e1484f3ae 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -76,3 +76,5 @@ tags: risk_score: 49 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml index fc55d84a0a..71ee3a9b5e 100644 --- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic is to look for known processes killed by industroyer2 malware. - This technique was seen in the industroyer2 malware attack that tries to kill several processes - of windows host machines related to the energy facility network. This anomaly might be a good - indicator to check which process kill these processes or why the process was killed. -search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") - | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `windows_processes_killed_by_industroyer2_malware_filter`' +description: The following analytic is to look for known processes killed by industroyer2 + malware. This technique was seen in the industroyer2 malware attack that tries to + kill several processes of windows host machines related to the energy facility network. + This anomaly might be a good indicator to check which process kill these processes + or why the process was killed. +search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by process_name process + process_path process_guid process_id EventCode dest user_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are - allowed to terminate this process during testing or updates. Filter as needed based on paths that - are used legitimately. + allowed to terminate this process during testing or updates. Filter as needed based + on paths that are used legitimately. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ tags: @@ -69,3 +70,5 @@ tags: - Processes.process_guid risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 55f9249c45..02e781ac67 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -79,3 +79,5 @@ tags: risk_score: 80 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml index 37e045b7b4..3aa562bd13 100644 --- a/detections/endpoint/windows_registry_delete_task_sd.yml +++ b/detections/endpoint/windows_registry_delete_task_sd.yml @@ -6,18 +6,27 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. - This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. - In addition, in order to perform this action, the user context will need to be SYSTEM. +description: The following analytic identifies a process attempting to delete a scheduled + task SD (Security Descriptor) from within the registry path of that task. This may + occur from a non-standard process running and may not come from reg.exe. This particular + behavior will remove the actual Task Name from the Task Scheduler GUI and from the + command-line query - schtasks.exe /query. In addition, in order to perform this + action, the user context will need to be SYSTEM. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) - by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_registry_delete_task_sd_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel. + where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" + Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) + by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data + Registry.status Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as the activity is not common + to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified + or Deleted values based on product that is in the datamodel. references: - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728 @@ -45,7 +54,7 @@ tags: - T1562 nist: - DE.CM - message: A scheduled task security descriptor was deleted from the registry on $dest$. + message: A scheduled task security descriptor was deleted from the registry on $dest$. observable: - name: dest type: Endpoint @@ -61,10 +70,12 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name + - Processes.process_id + - Processes.process_name - Processes.process - Processes.dest - - Processes.process_guid + - Processes.process_guid risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 7d59343cd5..ae5107d202 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -76,3 +76,5 @@ tags: risk_score: 80 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index 099b29e6a9..500688c271 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote - desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries - to enable RDP connection to the targeted host for remote access and potentially be for lateral movement. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") - AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_service_rdpwinst_tool_execution_filter`' +description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper + library tool designed to enable remote desktop host support and concurrent RDP session + on reduced functionality system. Unfortunately, this open project was abused by + adversaries to enable RDP connection to the targeted host for remote access and + potentially be for lateral movement. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") + AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed. +known_false_positives: This tool was designed for home usage and not commonly seen + in production environment. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -71,4 +73,6 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 81 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index d17c147471..bd2ab8b12e 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -7,25 +7,27 @@ type: Anomaly datamodel: - Endpoint description: The following analytic is to identify a modification in the Windows firewall - to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer - to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some - production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits - of attack to start lateral movement. + to enable remote desktop protocol on a targeted machine. This technique was seen + in several adversaries, malware or red teamer to remotely access the compromised + or targeted host by allowing this protocol in firewall. Even this protocol might + be allowed in some production environment, This TTP behavior is a good pivot to + check who and why the user want to enable this feature through firewall which is + also common traits of attack to start lateral movement. search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" - AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name + where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") + AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process + = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process + = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_services_allow_rdp_in_firewall_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -72,3 +74,5 @@ tags: - Processes.user risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index f8e182e452..ccf62a7fd0 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -73,3 +73,5 @@ tags: risk_score: 48 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index 8a79d7c9e5..a01d2fda92 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: +datamodel: - Endpoint description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. @@ -68,3 +68,5 @@ tags: - Processes.user risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml index fabd2ecd2d..b7b9133f04 100644 --- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml +++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml @@ -6,17 +6,22 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifes a new kernel driver being added to Windows using sc.exe. - Adding a Kernel driver is not common day to day and should be investigated to further understand the source. +description: The following analytic identifes a new kernel driver being added to Windows + using sc.exe. Adding a Kernel driver is not common day to day and should be investigated + to further understand the source. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe - Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present based on common applications adding new drivers, however, filter as needed. + Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_service_create_kernel_mode_driver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present based on common applications + adding new drivers, however, filter as needed. references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ tags: @@ -36,7 +41,8 @@ tags: impact: 60 kill_chain_phases: - Installation - message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$. + message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ + by $user$. mitre_attack_id: - T1543.003 - T1543 @@ -61,11 +67,13 @@ tags: - Processes.dest - Processes.user - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 48 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index f63fa31cd7..d9b00e771e 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -11,13 +11,13 @@ description: The following analytic identifies Windows Service Control, `sc.exe` instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_service_stop_by_deletion_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) + Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -73,3 +73,5 @@ tags: - Processes.user risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f1bd6ed549..18864c80fc 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -6,22 +6,26 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to logoff a windows host machine. - This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, - interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. - This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandlined to logoff a windows + host machine. This technique was seen in several APT, RAT like dcrat and other commodity + malware to shutdown the machine to add more impact, interrupt access, aid destruction + of the system like wiping disk or inhibit system recovery. This TTP is a good pivot + to check why application trigger this commandline which is not so common way to + logoff a machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) + Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine. +known_false_positives: Administrator may execute this commandline to trigger shutdown, + logoff or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor @@ -71,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 55ed3995c9..c85dd588db 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -6,23 +6,27 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to reboot a windows host machine. - This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, - interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. - This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine. - Compare to shutdown and logoff shutdown.exe feature, reboot seen in some automation script like ansible to reboot the machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandlined to reboot a windows + host machine. This technique was seen in several APT, RAT like dcrat and other commodity + malware to shutdown the machine to add more impact, interrupt access, aid destruction + of the system like wiping disk or inhibit system recovery. This TTP is a good pivot + to check why application trigger this commandline which is not so common way to + reboot a machine. Compare to shutdown and logoff shutdown.exe feature, reboot seen + in some automation script like ansible to reboot the machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) + Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. +known_false_positives: Administrator may execute this commandline to trigger shutdown + or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor @@ -72,3 +76,5 @@ tags: - Processes.parent_process_id risk_score: 30 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 9374e4c8d5..3f2fdbb2c5 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -6,22 +6,26 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to shutdown a windows host machine. - This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, - interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. - This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandlined to shutdown a + windows host machine. This technique was seen in several APT, RAT like dcrat and + other commodity malware to shutdown the machine to add more impact, interrupt access, + aid destruction of the system like wiping disk or inhibit system recovery. This + TTP is a good pivot to check why application trigger this commandline which is not + so common way to shutdown a machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) + Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. +known_false_positives: Administrator may execute this commandline to trigger shutdown + or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor @@ -71,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index bc9a0438ae..670a286f30 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies DCRat delay time tactics using w32tm. - This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe application to delay the execution of its payload like - c2 communication , beaconing and execution. This anomaly detection may help the analyst to check other possible event like the process who - execute this command that may lead to DCRat attack. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= "* /computer:localhost *" - Processes.process= "* /period:*" Processes.process= "* /dataonly *" Processes.process= "* /samples:*" - by Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_system_time_discovery_w32tm_delay_filter`' +description: The following analytic identifies DCRat delay time tactics using w32tm. + This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe + application to delay the execution of its payload like c2 communication , beaconing + and execution. This anomaly detection may help the analyst to check other possible + event like the process who execute this command that may lead to DCRat attack. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= + "* /computer:localhost *" Processes.process= "* /period:*" Processes.process= "* + /dataonly *" Processes.process= "* /samples:*" by Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -45,7 +45,8 @@ tags: impact: 60 kill_chain_phases: - Reconnaissance - message: Process name w32tm.exe is using suspcicious command line arguments $process$ on host $dest$. + message: Process name w32tm.exe is using suspcicious command line arguments $process$ + on host $dest$. mitre_attack_id: - T1124 nist: @@ -74,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml index 3740ca82ba..5ea153a8c2 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. - This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and - possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users - executes on the machines. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` - AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic identifies net.exe updating user account policies + for password requirement with non-expiring password. This technique was seen in + several adversaries and malware like Azorult to maintain the foothold (persistence), + gaining privilege escalation, defense evasion and possible for lateral movement + for specific users or created user account on the targeted host. This TTP detections + is a good pivot to see further what other events that users executes on the machines. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="* accounts *" AND Processes.process="* + /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This behavior is not commonly seen in production environment and not advisable, filter as needed. +known_false_positives: This behavior is not commonly seen in production environment + and not advisable, filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems @@ -73,4 +75,6 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index b215579384..fadb559859 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -87,3 +87,5 @@ tags: - user risk_score: 15 security_domain: threat + supported_tas: + - Splunk_TA_nginx diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml index 775e50f351..fbac4f97b1 100644 --- a/detections/web/spring4shell_payload_url_request.yml +++ b/detections/web/spring4shell_payload_url_request.yml @@ -6,18 +6,19 @@ author: Michael Haag, Splunk type: TTP datamodel: - Web -description: The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. - The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. -search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") - Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*") - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest - sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `spring4shell_payload_url_request_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. -known_false_positives: The jsp file names are static names used in current proof of concept code. = +description: The following analytic is static indicators related to CVE-2022-22963, + Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping + to exploit a web shell on the destination. The filename and cmd are arbitrary in + this exploitation. Java will write a JSP to disk and a process will spawn from Java + based on the cmd passed. This is indicative of typical web shell activity. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url + IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*") by Web.http_user_agent Web.http_method, + Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spring4shell_payload_url_request_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic that include fields relavent for traffic into the `Web` datamodel. +known_false_positives: The jsp file names are static names used in current proof of + concept code. = references: - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ - https://github.com/TheGejr/SpringShell @@ -70,3 +71,5 @@ tags: - Web.http_user_agent risk_score: 36 security_domain: network + supported_tas: + - Splunk_TA_nginx diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml index febd4024e9..609f00a292 100644 --- a/detections/web/web_jsp_request_via_url.yml +++ b/detections/web/web_jsp_request_via_url.yml @@ -6,18 +6,19 @@ author: Michael Haag, Splunk type: TTP datamodel: - Web -description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver. - The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. -search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") - Web.url IN ("*.jsp?cmd=*","*j&cmd=*") - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest - sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `web_jsp_request_via_url_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. -known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers. +description: The following analytic identifies the common URL requests used by a recent + CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver. + The filename and cmd are arbitrary in this exploitation. Java will write a JSP to + disk and a process will spawn from Java based on the cmd passed. This is indicative + of typical web shell activity. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url + IN ("*.jsp?cmd=*","*j&cmd=*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length + Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `web_jsp_request_via_url_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic that include fields relavent for traffic into the `Web` datamodel. +known_false_positives: False positives may be present with legitimate applications. + Attempt to filter by dest IP or use Asset groups to restrict to servers. references: - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ - https://github.com/TheGejr/SpringShell @@ -40,7 +41,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity. + message: A suspicious URL has been requested against $dest$ by $src$, related to + web shell activity. mitre_attack_id: - T1505.003 - T1505 @@ -69,4 +71,6 @@ tags: - Web.dest - Web.http_user_agent risk_score: 72 - security_domain: network \ No newline at end of file + security_domain: network + supported_tas: + - Splunk_TA_nginx diff --git a/security_content_automation/detection_ta_mapping.csv b/security_content_automation/detection_ta_mapping.csv index 4ce0deb0aa..24efed78e6 100644 --- a/security_content_automation/detection_ta_mapping.csv +++ b/security_content_automation/detection_ta_mapping.csv @@ -1,317 +1,393 @@ detection_name,cim_version,supported_tas,tas_with_cim_mapping -abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" -possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon -disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" -linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" +cloud_compute_instance_created_in_previously_unused_region,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +abnormally_high_number_of_cloud_security_group_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +cloud_provisioning_from_previously_unseen_region,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +cloud_provisioning_from_previously_unseen_city,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +cloud_provisioning_from_previously_unseen_ip_address,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose" +cloud_instance_modified_with_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose" +cloud_compute_instance_created_by_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_api_calls_from_previously_unseen_user_roles,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +cloud_provisioning_from_previously_unseen_country,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox" +spring4shell_payload_url_request,5.0.1,Splunk_TA_nginx,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +log4shell_jndi_payload_injection_attempt,5.0.1,Splunk_TA_nginx,Splunk_TA_nginx +vmware_workspace_one_freemarker_server_side_template_injection,5.0.1,,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +web_spring_cloud_function_functionrouter,5.0.1,,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +web_jsp_request_via_url,5.0.1,Splunk_TA_nginx,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +print_processor_registry_autostart,5.0.1,,Splunk_TA_bit9-carbonblack +dns_query_length_with_high_standard_deviation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_isc-bind, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" +f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388,5.0.1,,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +windows_service_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +process_kill_base_on_file_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +schtasks_scheduling_job_on_remote_system,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +shim_database_installation_with_suspicious_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_firewall_with_netsh,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_binary_proxy_execution_mavinject_dll_injection,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_controller_discovery_with_nltest,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___syssetup,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_command_and_scripting_interpreter_path_traversal_exec,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +slui_runas_elevated,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_hide_notification_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +silentcleanup_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +deleting_shadow_copies,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +clop_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_remote_service_rdpwinst_tool_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsreset_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_nirsoft_advancedrun,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +resize_shadowstorage_volume,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +attempted_credential_dump_from_registry_via_reg_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_process_file_path,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +slui_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_modify_registry_disable_windows_security_center_notif,5.0.1,,Splunk_TA_bit9-carbonblack +registry_keys_for_creating_shim_databases,5.0.1,,Splunk_TA_bit9-carbonblack +wermgr_process_spawned_cmd_or_powershell_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_obfuscated_files_or_information_base64_decode,5.0.1,,Splunk_TA_microsoft_sysmon +windows_disableantispyware_reg,5.0.1,,Splunk_TA_bit9-carbonblack +disabling_norun_windows_app,5.0.1,,Splunk_TA_bit9-carbonblack +single_letter_process_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR" +batch_file_write_to_system32,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_folderoptions_windows_feature,5.0.1,,Splunk_TA_bit9-carbonblack +linux_system_network_discovery,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_curl_upload_to_remote_destination,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_lock_workstation_feature_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +wsmprovhost_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +malicious_powershell_process___execution_policy_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +vbscript_execution_using_wscript_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +ntdsutil_export_ntds,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_system_shutdown_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +jscript_execution_using_cscript_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_remote_services_allow_remote_assistance,5.0.1,,Splunk_TA_bit9-carbonblack +add_defaultuser_and_password_in_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_adfind_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +fsutil_zeroing_file,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +detect_rclone_command_line_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_profile_config_file,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_office_product_spawning_msdt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +nishang_powershelltcponeline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_sharphound_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_procdump,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +domain_account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_disable_shutdown_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_modify_show_compress_color_and_info_tip_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +msbuild_suspicious_spawned_by_script_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_taskkill,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_impair_defense_deny_security_software_with_applocker,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_raccine_scheduled_task_deletion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_startw,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_psexec_with_accepteula_flag,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_aduserresultantpasswordpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +allow_file_and_printing_sharing_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +eventvwr_uac_bypass,5.0.1,,Splunk_TA_bit9-carbonblack +regsvr32_silent_and_install_param_dll_loading,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_valid_account_with_never_expires_password,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_to_safe_mode_with_network_config,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +control_loading_from_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_scheduled_task_from_public_directory,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +cmd_echo_pipe___escalation,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_at_allow_config_file,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +winhlp32_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_doas_conf_file_creation,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_modify_registry_disable_toast_notifications,5.0.1,,Splunk_TA_bit9-carbonblack +permission_modification_using_takeown_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +detect_rundll32_application_control_bypass___advpack,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +create_or_delete_windows_shares_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +anomalous_usage_of_7zip,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_install_kernel_module_using_modprobe_utility,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_remote_assistance_spawning_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_used_for_privilege_escalation,5.0.1,,Splunk_TA_bit9-carbonblack +windows_command_shell_dcrat_forkbomb_payload,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_account_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_change_file_owner_to_root,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +executables_or_script_creation_in_suspicious_path,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +suspicious_copy_on_system32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_download_with_urlcache_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_registry_modification_for_safe_mode_persistence,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +hiding_files_and_directories_with_attrib_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +enable_rdp_in_other_port_number,5.0.1,,Splunk_TA_bit9-carbonblack +dsquery_domain_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +credential_dumping_via_copy_command_from_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +malicious_powershell_process_with_obfuscation_techniques,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +creation_of_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +any_powershell_downloadstring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bcdedit_command_back_to_normal_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_deleted_registry_by_a_non_critical_process_file_path,5.0.1,,Splunk_TA_bit9-carbonblack +detect_html_help_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_creation_using_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack +dump_lsass_via_comsvcs_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_high_frequency_of_file_deletion_in_boot_folder,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_curl_download_to_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +powershell_disable_security_monitoring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +icacls_grant_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +nltest_domain_trust_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +disable_amsi_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +detect_mshta_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +revil_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack +linux_file_created_in_kernel_driver_directory,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_system_time_discovery_w32tm_delay,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +system_information_discovery_detection,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR" +uninstall_app_using_msiexec,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +detect_rundll32_application_control_bypass___setupapi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +w3wp_spawning_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_registry_delete_task_sd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +powershell_start_bitstransfer,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +hide_user_account_from_sign_in_screen,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +get_domaintrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +samsam_test_file_write,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR" +prevent_automatic_repair_mode_using_bcdedit,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +detect_regsvr32_application_control_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +schtasks_used_for_forcing_a_reboot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_deletion_of_services,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +svchost_exe_lolbas_execution_process_spawn,5.0.1,,Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_systemrestore_in_registry,5.0.1,,Splunk_TA_bit9-carbonblack +linux_possible_ssh_key_file_creation,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +linux_nopasswd_entry_in_sudoers_file,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +create_local_admin_accounts_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_processes_used_for_system_network_configuration_discovery,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +processes_launching_netsh,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +excessive_distinct_processes_from_windows_temp,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR" +wget_download_and_bash_execution,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +process_creating_lnk_file_in_suspicious_location,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +bcdedit_failure_recovery_modification,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_remote_access_software_rms_registry,5.0.1,,Splunk_TA_bit9-carbonblack +services_escalate_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +scheduled_task_deleted_or_created_via_cmd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +wscript_or_cscript_suspicious_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_at_application_execution,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_indirect_command_execution_via_forfiles,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_disable_logoff_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +sdclt_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +clear_unallocated_sector_using_cipher_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +usn_journal_deletion,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +certutil_with_decode_argument,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_service_restarted,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +credential_dumping_via_symlink_to_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +conti_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +fodhelper_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +disable_schedule_task,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_system_reboot_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_azurehound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_wmi_command_attempt,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_file_creation_in_init_boot_directory,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +active_setup_registry_autostart,5.0.1,,Splunk_TA_bit9-carbonblack +linux_possible_access_to_credential_files,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_controlpanel,5.0.1,,Splunk_TA_bit9-carbonblack +windows_impair_defense_delete_win_defender_profile_registry,5.0.1,,Splunk_TA_bit9-carbonblack +possible_lateral_movement_powershell_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dns_exfiltration_using_nslookup_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_path_interception_by_creation_of_program_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_visudo_utility_execution,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +elevated_group_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_regsvr32_register_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_plugininit,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bits_job_persistence,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sc_exe_manipulating_windows_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +shim_database_file_creation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_ossec, Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +excessive_number_of_taskhost_processes,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +scheduled_task_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bitsadmin_download_file,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_rundll32_with_no_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_registry_tool,5.0.1,,Splunk_TA_bit9-carbonblack +linux_decode_base64_to_shell,5.0.1,,Splunk_TA_microsoft_sysmon +curl_download_and_bash_execution,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +elevated_group_discovery_with_net,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_cmd_application,5.0.1,,Splunk_TA_bit9-carbonblack +linux_deletion_of_ssl_certificate,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +short_lived_windows_accounts,5.0.1,,"Splunk_TA_cyberark, Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose" +spoolsv_writing_a_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +get_domainuser_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +ryuk_wake_on_lan_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +unified_messaging_service_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +getwmiobject_ds_user_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +office_application_spawn_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_etw_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +rundll32_with_no_command_line_arguments_with_network,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_mshta,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_number_of_service_control_start_as_disabled,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_odbcconf_load_response_file,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_download_with_verifyctl_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_deletion_of_cron_jobs,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +suspicious_msbuild_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_impair_defenses_disable_win_defender_auto_logging,5.0.1,,Splunk_TA_bit9-carbonblack +linux_kernel_module_enumeration,5.0.1,,Splunk_TA_microsoft_sysmon +office_product_spawn_cmd_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_memory_crash_dump,5.0.1,,Splunk_TA_bit9-carbonblack +serviceprincipalnames_discovery_with_setspn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_doas_tool_execution,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +suspicious_rundll32_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_microsoft_workflow_compiler_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_cacls_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_iptables_firewall_modification,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +remote_process_instantiation_via_winrm_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getdomaincomputer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_icedid_rundll32_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_java_spawning_shell,5.0.1,,Splunk_TA_microsoft_sysmon +windows_schtasks_create_run_as_system,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +firewall_allowed_program_enable,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +suspicious_gpupdate_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_registry_certificate_added,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +suspicious_mshta_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +revil_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +wmic_xsl_execution_via_url,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +potentially_malicious_code_on_commandline,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_ssh_remote_services_script_execute,5.0.1,,Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_modify_registry_regedit_silent_reg_import,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +monitor_registry_keys_for_print_monitors,5.0.1,,Splunk_TA_bit9-carbonblack +cmdline_tool_not_executed_in_cmd_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_dism_remove_defender,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_using_infotech_storage_handlers,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_spawn_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +time_provider_persistence_registry,5.0.1,,Splunk_TA_bit9-carbonblack +attacker_tools_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_service_stop_by_deletion,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +excessive_service_stop_attempt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +icacls_deny_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_deleting_critical_directory_using_rm_command,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disable_windows_behavior_monitoring,5.0.1,,Splunk_TA_bit9-carbonblack +script_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR" +secretdumps_offline_ntds_dumping_tool,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +remote_process_instantiation_via_winrm_and_winrs,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_clipboard_data_copy,5.0.1,,Splunk_TA_microsoft_sysmon +rubeus_command_line_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +linux_disable_services,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +unload_sysmon_filter_driver,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +process_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_task_manager,5.0.1,,Splunk_TA_bit9-carbonblack +certutil_exe_certificate_extraction,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_windows_group_policy_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +file_with_samsam_extension,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR" +rundll32_control_rundll_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getdomaingroup_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_default_file_association,5.0.1,,Splunk_TA_bit9-carbonblack +rundll32_lockworkstation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +ping_sleep_batch_command,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_remote_user_account_control,5.0.1,,Splunk_TA_bit9-carbonblack +linux_sudoers_tmp_file_creation,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +overwriting_accessibility_binaries,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_ossec, Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR" +rundll_loading_dll_by_ordinal,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_access_or_modification_of_sshd_config_file,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +system_processes_run_from_unexpected_locations,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +spoolsv_spawning_rundll32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_security_account_manager_stopped,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR" +windows_process_with_namedpipe_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wbadmin_delete_system_backups,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +xsl_script_execution_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_add_files_in_known_crontab_directories,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +extraction_of_registry_hives,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_mof_event_triggered_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_used_for_persistence,5.0.1,,Splunk_TA_bit9-carbonblack +windows_modify_registry_disable_win_defender_raw_write_notif,5.0.1,,Splunk_TA_bit9-carbonblack +scheduled_task_creation_on_remote_endpoint_using_at,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_attempt_to_disable_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_indirect_command_execution_via_pcalua,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +windows_dotnet_binary_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_searchprotocolhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_msiexec_unregister_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +attempt_to_stop_security_service,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +java_class_file_download_by_java_user_agent,5.0.1,,"Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx" +linux_deletion_of_init_daemon_script,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +getwmiobject_ds_computer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_stop_services,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +net_profiler_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_msiexec_spawn_discovery_command,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_ssh_authorized_keys_modification,5.0.1,,Splunk_TA_microsoft_sysmon +windows_disable_change_password_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +windows_remote_services_rdp_enable,5.0.1,,Splunk_TA_bit9-carbonblack +linux_at_allow_config_file_creation,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +excel_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +logon_script_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +windows_processes_killed_by_industroyer2_malware,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +impacket_lateral_movement_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_application_spawn_rundll32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_operation_with_consent_admin,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +linux_preload_hijack_library_calls,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_installutil_credential_theft,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_create_kernel_mode_driver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_net_user_account,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_exchange_web_shell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +windows_system_logoff_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_msiexec_remote_download,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +regsvr32_with_known_silent_switch_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_pkexec_privilege_escalation,5.0.1,,Splunk_TA_microsoft_sysmon +reg_exe_manipulating_windows_services_registry_keys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_insert_kernel_module_using_insmod_utility,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +add_or_set_windows_defender_exclusion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_linux_discovery_commands,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +office_product_spawning_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_logs_using_wevtutil,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +deleting_of_net_users,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sdelete_application_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +rundll32_shimcache_flush,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_writes_to_windows_recycle_bin,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +modify_acl_permission_to_files_or_folder,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_remote_services_allow_rdp_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +any_powershell_downloadfile,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +schtasks_run_task_on_demand,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +remote_system_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_reg_exe_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_msiexec_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_access_to_sudoers_file,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_modify_registry_disabling_wer_settings,5.0.1,,Splunk_TA_bit9-carbonblack +remote_process_instantiation_via_dcom_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +screensaver_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +get_domainpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +msmpeng_application_dll_side_loading,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +services_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +auto_admin_logon_registry_entry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +ryuk_test_files_detected,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR" +check_elevated_cmd_using_whoami,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +creation_of_shadow_copy_with_wmic_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_shred_overwrite_command,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_file_without_extension_in_critical_folder,5.0.1,,Splunk_TA_bit9-carbonblack +linux_dd_file_overwrite,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disable_windows_app_hotkeys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +getwmiobject_ds_group_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_spawning_control,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execute_javascript_with_jscript_com_clsid,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +mshta_spawning_rundll32_or_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_network_discovery_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_dllhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_high_frequency_of_file_deletion_in_etc_folder,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +winword_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_modify_registry_disallow_windows_app,5.0.1,,Splunk_TA_bit9-carbonblack +detect_sharphound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +wmiprsve_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_wevtutil_usage,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_execute_arbitrary_commands_with_msdt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_service_started_or_enabled,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +office_document_spawned_child_process_to_download,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_odbcconf_load_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +attempt_to_add_certificate_to_untrusted_store,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows" +linux_setuid_using_setcap_utility,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_modify_registry_suppress_win_defender_notif,5.0.1,,Splunk_TA_bit9-carbonblack +linux_setuid_using_chmod_utility,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +office_product_spawning_certutil,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_creation_in_profile_directory,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +windows_service_creation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_account_manipulation_of_ssh_config_and_keys,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" +office_product_spawning_bitsadmin,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_service_file_created_in_systemd_directory,5.0.1,,"Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack" diff --git a/security_content_automation/detection_ta_mapping.yml b/security_content_automation/detection_ta_mapping.yml index ffb96a2eb7..681302b52e 100644 --- a/security_content_automation/detection_ta_mapping.yml +++ b/security_content_automation/detection_ta_mapping.yml @@ -1,2150 +1,2638 @@ abnormally_high_number_of_cloud_infrastructure_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_juniper + - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - - Splunk_TA_ossec - - Splunk_TA_juniper - - splunk_ta_o365 - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_cisco-asa - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_rsa-securid + - Splunk_TA_cisco-asa + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox abnormally_high_number_of_cloud_security_group_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_juniper + - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - - Splunk_TA_ossec - - Splunk_TA_juniper - - splunk_ta_o365 - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_cisco-asa - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_rsa-securid + - Splunk_TA_cisco-asa + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox account_discovery_with_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon active_setup_registry_autostart: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon add_defaultuser_and_password_in_registry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack add_or_set_windows_defender_exclusion: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_file_and_printing_sharing_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -allow_inbound_traffic_by_firewall_rule_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon allow_network_discovery_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_operation_with_consent_admin: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack anomalous_usage_of_7zip: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows any_powershell_downloadfile: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon any_powershell_downloadstring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attacker_tools_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows attempt_to_add_certificate_to_untrusted_store: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows attempt_to_stop_security_service: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attempted_credential_dump_from_registry_via_reg_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon auto_admin_logon_registry_entry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack batch_file_write_to_system32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bcdedit_command_back_to_normal_mode_boot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows bcdedit_failure_recovery_modification: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bits_job_persistence: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon bitsadmin_download_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_urlcache_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_verifyctl_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_exe_certificate_extraction: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_with_decode_argument: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon change_default_file_association: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon change_to_safe_mode_with_network_config: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows check_elevated_cmd_using_whoami: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows clear_unallocated_sector_using_cipher_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon clop_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cloud_api_calls_from_previously_unseen_user_roles: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - - splunk_ta_o365 - - Splunk_TA_box - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox cloud_compute_instance_created_by_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_compute_instance_created_in_previously_unused_region: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_image: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_instance_type: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_instance_modified_with_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_juniper + - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix + - Splunk_TA_cyberark + - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - - Splunk_TA_ossec - - Splunk_TA_juniper - - splunk_ta_o365 - - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_city: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - - Splunk_TA_citrix-netscaler - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - Splunk_TA_juniper - - splunk_ta_o365 + - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_cisco-asa - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_rsa-securid + - Splunk_TA_cisco-asa + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox cloud_provisioning_from_previously_unseen_country: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - - Splunk_TA_citrix-netscaler - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - Splunk_TA_juniper - - splunk_ta_o365 + - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_cisco-asa - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_rsa-securid + - Splunk_TA_cisco-asa + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox cloud_provisioning_from_previously_unseen_ip_address: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: + - Splunk_TA_juniper - Splunk_TA_citrix-netscaler + - Splunk_TA_cyberark + - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - - Splunk_TA_juniper - - splunk_ta_o365 - - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_region: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - - Splunk_TA_citrix-netscaler - - Splunk_TA_rsa-securid - - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_rsa_securid_cas - Splunk_TA_juniper - - splunk_ta_o365 + - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - - Splunk_TA_box - - Splunk_TA_cisco-asa - - Splunk_TA_infoblox - Splunk_TA_salesforce + - Splunk_TA_rsa_securid_cas + - Splunk_TA_box + - splunk_ta_o365 + - Splunk_TA_rsa-securid + - Splunk_TA_cisco-asa + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_infoblox cmd_echo_pipe___escalation: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cmdline_tool_not_executed_in_cmd_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon conti_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon control_loading_from_world_writable_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_local_admin_accounts_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_or_delete_windows_shares_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy_with_wmic_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_copy_command_from_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_symlink_to_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon curl_download_and_bash_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows deleting_of_net_users: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon deleting_shadow_copies: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_azurehound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_exchange_web_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR detect_html_help_spawn_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_using_infotech_storage_handlers: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_path_interception_by_creation_of_program_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_processes_used_for_system_network_configuration_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_psexec_with_accepteula_flag: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rclone_command_line_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regasm_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows detect_regasm_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvcs_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows detect_regsvcs_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvr32_application_control_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___advpack: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___setupapi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___syssetup: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_sharphound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows detect_sharphound_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_use_of_cmd_exe_to_launch_script_interpreters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows disable_amsi_through_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_defender_antivirus_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_mpengine_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_submit_samples_consent_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disable_etw_through_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disable_logs_using_wevtutil: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack disable_registry_tool: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disable_schedule_task: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -disable_security_logs_using_minint_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disable_windows_app_hotkeys: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack disable_windows_behavior_monitoring: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_cmd_application: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_controlpanel: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_defender_services: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disabling_firewall_with_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_folderoptions_windows_feature: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_net_user_account: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_norun_windows_app: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +disabling_remote_user_account_control: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_systemrestore_in_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_task_manager: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon dns_exfiltration_using_nslookup_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dns_query_length_with_high_standard_deviation: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_isc-bind - Splunk_TA_microsoft_sysmon + - Splunk_TA_isc-bind - Splunk_TA_CrowdStrike_FDR - Splunk_TA_infoblox domain_account_discovery_with_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows domain_account_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows domain_controller_discovery_with_nltest: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dsquery_domain_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR dump_lsass_via_comsvcs_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dump_lsass_via_procdump: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR elevated_group_discovery_with_net: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon elevated_group_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon enable_rdp_in_other_port_number: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -etw_registry_disabled: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon eventvwr_uac_bypass: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon excel_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_attempt_to_disable_services: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -excessive_number_of_distinct_processes_created_in_windows_temp_folder: - cim_version: 5.0.0 +excessive_distinct_processes_from_windows_temp: + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm + - Splunk_TA_CrowdStrike_FDR excessive_number_of_service_control_start_as_disabled: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows excessive_number_of_taskhost_processes: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_service_stop_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_cacls_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_usage_of_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_taskkill: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR executables_or_script_creation_in_suspicious_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR execute_javascript_with_jscript_com_clsid: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows execution_of_file_with_multiple_extensions: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows extraction_of_registry_hives: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_squid + - Splunk_TA_citrix-netscaler + - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx file_with_samsam_extension: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - splunk_ta_o365 - - Splunk_TA_sophos + - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark + - Splunk_TA_sophos - Splunk_TA_windows + - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR firewall_allowed_program_enable: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows fodhelper_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows fsutil_zeroing_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows get_aduserresultantpasswordpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows get_domainpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows get_domaintrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon get_domainuser_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows get_foresttrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaincomputer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaingroup_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_computer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_group_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_user_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows hide_user_account_from_sign_in_screen: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack hiding_files_and_directories_with_attrib_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows icacls_deny_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR icacls_grant_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR impacket_lateral_movement_commandline_parameters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon java_class_file_download_by_java_user_agent: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_citrix-netscaler - - Splunk_TA_nginx - - Splunk_TA_microsoft-iis - - Splunk_TA_websense-cg - Splunk_TA_squid - - Splunk_TA_haproxy - - Splunk_TA_mcafee-wg + - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx jscript_execution_using_cscript_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +linux_account_manipulation_of_ssh_config_and_keys: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_add_files_in_known_crontab_directories: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_at_allow_config_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_at_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_change_file_owner_to_root: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_clipboard_data_copy: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_dd_file_overwrite: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_decode_base64_to_shell: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_deleting_critical_directory_using_rm_command: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_deletion_of_cron_jobs: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_deletion_of_init_daemon_script: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_deletion_of_services: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_deletion_of_ssl_certificate: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_disable_services: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_doas_conf_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_doas_tool_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_file_created_in_kernel_driver_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_file_creation_in_init_boot_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_file_creation_in_profile_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_high_frequency_of_file_deletion_in_boot_folder: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +linux_high_frequency_of_file_deletion_in_etc_folder: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_insert_kernel_module_using_insmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_install_kernel_module_using_modprobe_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_iptables_firewall_modification: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_java_spawning_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_kernel_module_enumeration: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_nopasswd_entry_in_sudoers_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR +linux_obfuscated_files_or_information_base64_decode: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon linux_pkexec_privilege_escalation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_possible_access_or_modification_of_sshd_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_credential_files: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_sudoers_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_at_allow_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_profile_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_ssh_key_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_preload_hijack_library_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_file_created_in_systemd_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack linux_service_restarted: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_started_or_enabled: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_chmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_setcap_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_shred_overwrite_command: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_ssh_authorized_keys_modification: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_ssh_remote_services_script_execute: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_stop_services: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_sudoers_tmp_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -linux_visudo_utility_execution: - cim_version: 5.0.0 + - Splunk_TA_bit9-carbonblack +linux_system_network_discovery: + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -logon_script_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: +linux_visudo_utility_execution: + cim_version: 5.0.1 + tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +log4shell_jndi_payload_injection_attempt: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_nginx + tas_with_cim_mapping: + - Splunk_TA_nginx +logon_script_event_trigger_execution: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon malicious_powershell_process___execution_policy_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon malicious_powershell_process_with_obfuscation_techniques: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows mmc_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon modify_acl_permission_to_files_or_folder: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR +monitor_registry_keys_for_print_monitors: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack msbuild_suspicious_spawned_by_script_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon mshta_spawning_rundll32_or_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon msmpeng_application_dll_side_loading: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR net_profiler_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack nishang_powershelltcponeline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon nltest_domain_trust_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows ntdsutil_export_ntds: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows office_application_spawn_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_application_spawn_rundll32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_document_spawned_child_process_to_download: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawn_cmd_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_bitsadmin: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_certutil: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_mshta: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_rundll32_with_no_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_spawning_control: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon overwriting_accessibility_binaries: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_nix - Splunk_TA_ossec - - Splunk_TA_bit9-carbonblack + - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - - splunk_ta_o365 - - Splunk_TA_sophos + - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark + - Splunk_TA_sophos - Splunk_TA_windows + - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR permission_modification_using_takeown_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack ping_sleep_batch_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon possible_lateral_movement_powershell_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon potentially_malicious_code_on_commandline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows powershell_disable_security_monitoring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon powershell_start_bitstransfer: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon prevent_automatic_repair_mode_using_bcdedit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack print_processor_registry_autostart: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon process_creating_lnk_file_in_suspicious_location: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR process_execution_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR process_kill_base_on_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon processes_launching_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows recursive_delete_of_directory_in_batch_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon reg_exe_manipulating_windows_services_registry_keys: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -registry_keys_used_for_persistence: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon +registry_keys_for_creating_shim_databases: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +registry_keys_used_for_persistence: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +registry_keys_used_for_privilege_escalation: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon regsvr32_silent_and_install_param_dll_loading: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon regsvr32_with_known_silent_switch_cmdline: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_dcom_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_winrs: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_system_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_wmi_command_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows resize_shadowstorage_volume: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows revil_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack revil_registry_entry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -rundll32_control_rundll_world_writable_directory: - cim_version: 5.0.0 +rubeus_command_line_parameters: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +rundll32_control_rundll_world_writable_directory: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +rundll32_lockworkstation: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows rundll32_shimcache_flush: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_with_no_command_line_arguments_with_network: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -ryuk_wake_on_lan_command: - cim_version: 5.0.0 +rundll_loading_dll_by_ordinal: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -samsam_test_file_write: - cim_version: 5.0.0 +ryuk_test_files_detected: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - splunk_ta_o365 - - Splunk_TA_sophos + - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark + - Splunk_TA_sophos - Splunk_TA_windows + - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR -sc_exe_manipulating_windows_services: - cim_version: 5.0.0 +ryuk_wake_on_lan_command: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +samsam_test_file_write: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_cyberark + - Splunk_TA_sophos + - Splunk_TA_windows + - splunk_ta_o365 + - Splunk_TA_CrowdStrike_FDR +sc_exe_manipulating_windows_services: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR scheduled_task_creation_on_remote_endpoint_using_at: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon scheduled_task_deleted_or_created_via_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows scheduled_task_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon schtasks_run_task_on_demand: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_scheduling_job_on_remote_system: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_used_for_forcing_a_reboot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR screensaver_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon script_execution_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm + - Splunk_TA_CrowdStrike_FDR sdclt_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack sdelete_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon secretdumps_offline_ntds_dumping_tool: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack serviceprincipalnames_discovery_with_setspn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon services_escalate_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows services_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon set_default_powershell_execution_policy_to_unrestricted_or_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +shim_database_file_creation: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_ossec + - Splunk_TA_nix + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR shim_database_installation_with_suspicious_parameters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR short_lived_windows_accounts: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: + - Splunk_TA_cyberark - Splunk_TA_microsoft-cloudservices - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose - - Splunk_TA_cyberark silentcleanup_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack single_letter_process_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm + - Splunk_TA_CrowdStrike_FDR slui_runas_elevated: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows slui_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows spoolsv_spawning_rundll32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon spoolsv_writing_a_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR -start_up_during_safe_mode_boot: - cim_version: 5.0.0 +spring4shell_payload_url_request: + cim_version: 5.0.1 supported_tas: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_nginx tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon + - Splunk_TA_squid + - Splunk_TA_citrix-netscaler + - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx suspicious_copy_on_system32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_dllhost_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_gpupdate_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_icedid_rundll32_cmdline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +suspicious_linux_discovery_commands: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_microsoft_workflow_compiler_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -suspicious_msbuild_rename: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_mshta_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows suspicious_mshta_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_process_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows suspicious_reg_exe_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_regsvr32_register_suspicious_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_dllregisterserver: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_plugininit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_startw: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_scheduled_task_from_public_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows suspicious_searchprotocolhost_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_wevtutil_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +suspicious_writes_to_windows_recycle_bin: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR svchost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon system_information_discovery_detection: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm + - Splunk_TA_CrowdStrike_FDR system_processes_run_from_unexpected_locations: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR time_provider_persistence_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon unified_messaging_service_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows uninstall_app_using_msiexec: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows unload_sysmon_filter_driver: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR usn_journal_deletion: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows vbscript_execution_using_wscript_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +vmware_workspace_one_freemarker_server_side_template_injection: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_squid + - Splunk_TA_citrix-netscaler + - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx w3wp_spawning_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wbadmin_delete_system_backups: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR +web_jsp_request_via_url: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_nginx + tas_with_cim_mapping: + - Splunk_TA_squid + - Splunk_TA_citrix-netscaler + - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx +web_spring_cloud_function_functionrouter: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_squid + - Splunk_TA_citrix-netscaler + - Splunk_TA_cisco-wsa + - Splunk_TA_mcafee-wg + - Splunk_TA_haproxy + - Splunk_TA_websense-cg + - Splunk_TA_microsoft-iis + - Splunk_TA_nginx wermgr_process_spawned_cmd_or_powershell_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wget_download_and_bash_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows windows_adfind_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +windows_binary_proxy_execution_mavinject_dll_injection: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_command_and_scripting_interpreter_path_traversal_exec: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_command_shell_dcrat_forkbomb_payload: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_curl_download_to_suspicious_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_curl_upload_to_remote_destination: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_disableantispyware_reg: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon +windows_deleted_registry_by_a_non_critical_process_file_path: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack +windows_disable_change_password_through_registry: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_disable_lock_workstation_feature_through_registry: + cim_version: 5.0.1 + supported_tas: - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_disable_logoff_button_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_disable_memory_crash_dump: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_disable_shutdown_button_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_disable_windows_group_policy_features_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_disableantispyware_reg: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack windows_dism_remove_defender: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_dotnet_binary_in_non_standard_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_execute_arbitrary_commands_with_msdt: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_file_without_extension_in_critical_folder: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_hide_notification_features_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_impair_defense_delete_win_defender_profile_registry: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_impair_defense_deny_security_software_with_applocker: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_impair_defenses_disable_win_defender_auto_logging: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_indirect_command_execution_via_forfiles: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +windows_indirect_command_execution_via_pcalua: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows windows_installutil_credential_theft: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_in_non_standard_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_uninstall_option: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_modify_registry_disable_toast_notifications: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_registry_disable_win_defender_raw_write_notif: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_registry_disable_windows_security_center_notif: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_registry_disabling_wer_settings: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_registry_disallow_windows_app: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_registry_regedit_silent_reg_import: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_modify_registry_suppress_win_defender_notif: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_modify_show_compress_color_and_info_tip_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_mof_event_triggered_execution_via_wmi: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_msiexec_dllregisterserver: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_msiexec_remote_download: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_msiexec_spawn_discovery_command: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_msiexec_unregister_dllregisterserver: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_nirsoft_advancedrun: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_odbcconf_load_dll: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_odbcconf_load_response_file: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_office_product_spawning_msdt: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_process_with_namedpipe_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_processes_killed_by_industroyer2_malware: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_raccine_scheduled_task_deletion: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_registry_certificate_added: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_registry_delete_task_sd: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_registry_modification_for_safe_mode_persistence: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack +windows_remote_access_software_rms_registry: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_remote_assistance_spawning_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_remote_service_rdpwinst_tool_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_remote_services_allow_rdp_in_firewall: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +windows_remote_services_allow_remote_assistance: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_remote_services_rdp_enable: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_schtasks_create_run_as_system: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_security_account_manager_stopped: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_cyberark_epm + - Splunk_TA_CrowdStrike_FDR +windows_service_create_kernel_mode_driver: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_service_creation_using_registry_entry: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack windows_service_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_service_stop_by_deletion: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +windows_system_logoff_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_system_reboot_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_system_shutdown_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_system_time_discovery_w32tm_delay: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_valid_account_with_never_expires_password: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winhlp32_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmic_xsl_execution_via_url: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmiprsve_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wscript_or_cscript_suspicious_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsmprovhost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsreset_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack xsl_script_execution_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows From 99d0b47a1452fd0886e59a93e227cabbaa2e4f6d Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 2 Aug 2022 11:22:22 -0400 Subject: [PATCH 05/10] Update active_directory_password_spraying.yml --- stories/active_directory_password_spraying.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index 296f5127f6..c9f20df254 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -23,7 +23,7 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents - 9 detection analytics which can aid defenders in identifyng instances where one + 9 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate From c9099e8a41f725c51df19876dc82f992be37ed99 Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 2 Aug 2022 11:28:58 -0400 Subject: [PATCH 06/10] doing a fix to pass appcert --- detections/endpoint/potential_password_in_username.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index ee672b6ca4..6663127819 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime | lookup ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon - | eval incorrect_password=user + | eval incorrect_cred=user | eval endtime=endtime+1000 | map maxsearches=70 search="| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype @@ -29,10 +29,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` | `potential_password_in_username_false_positive_reduction` - | eval incorrect_password=\"$incorrect_password$\" + | eval incorrect_cred=\"$incorrect_cred$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" - | where user!=incorrect_password + | where user!=incorrect_cred | outlier action=RM count | `potential_password_in_username_filter`' how_to_implement: To successfully implement this search, you need to have relevant @@ -92,4 +92,4 @@ tags: - Authentication.dest - sourcetype risk_score: 21 - security_domain: access \ No newline at end of file + security_domain: access From 939493337df6da685080d54a54f9e56d5d260829 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 3 Aug 2022 17:34:32 -0400 Subject: [PATCH 07/10] adding research site links --- .../contentctl_core/domain/entities/detection_tags.py | 1 + .../adapter/obj_to_yml_adapter.py | 10 ++++++++-- .../ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + dist/ssa/srs/ssa___attempt_to_delete_services.yml | 1 + dist/ssa/srs/ssa___attempt_to_disable_services.yml | 1 + ...mpted_credential_dump_from_registry_via_reg_exe.yml | 1 + .../ssa___bcdedit_failure_recovery_modification.yml | 1 + ...ssa___clear_unallocated_sector_using_cipher_app.yml | 1 + dist/ssa/srs/ssa___delete_a_net_user.yml | 1 + .../srs/ssa___deny_permission_using_cacls_utility.yml | 1 + ...detect_prohibited_applications_spawning_cmd_exe.yml | 1 + .../ssa/srs/ssa___detect_rclone_command_line_usage.yml | 1 + dist/ssa/srs/ssa___disable_net_user_account.yml | 1 + .../srs/ssa___dns_exfiltration_using_nslookup_app.yml | 1 + dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 1 + .../srs/ssa___grant_permission_using_cacls_utility.yml | 1 + ...___hiding_files_and_directories_with_attrib_exe.yml | 1 + ...sa___modify_acls_permission_of_files_or_folders.yml | 1 + dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 1 + dist/ssa/srs/ssa___sdelete_application_execution.yml | 1 + ...system_process_running_from_unexpected_location.yml | 1 + dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 1 + dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 1 + dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 1 + dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 1 + dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 1 + dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 1 + .../srs/ssa___windows_certutil_urlcache_download.yml | 1 + .../srs/ssa___windows_certutil_verifyctl_download.yml | 1 + ...ssa___windows_curl_upload_to_remote_destination.yml | 1 + ...a___windows_defender_tools_in_non_standard_path.yml | 1 + .../srs/ssa___windows_diskshadow_proxy_execution.yml | 1 + ...sa___windows_dotnet_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml | 1 + ...sa___windows_lolbin_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_mshta_child_process.yml | 1 + dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 1 + .../srs/ssa___windows_mshta_inline_hta_execution.yml | 1 + ...wershell_connect_to_internet_with_hidden_window.yml | 1 + dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 1 + .../ssa___windows_powershell_start_bitstransfer.yml | 1 + dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 1 + .../srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 1 + .../ssa___windows_rundll32_inline_hta_execution.yml | 1 + .../srs/ssa___windows_script_host_spawn_msbuild.yml | 1 + dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 1 + 46 files changed, 53 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 51081a8e89..6b107836ed 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -37,6 +37,7 @@ class DetectionTags(BaseModel): risk_level: str = None observable_str: str = None kill_chain_phases_id: list = None + research_site_url: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 52f382511b..bda2fb25d6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -14,6 +14,7 @@ class ObjToYmlAdapter(Adapter): def writeObjectsInPlace(self, objects: list) -> None: for object in objects: + file_path = object['file_path'] object.pop('file_path') object.pop('deprecated') @@ -28,6 +29,11 @@ class ObjToYmlAdapter(Adapter): file_path = os.path.join(output_path, 'complex', file_name) else: file_path = os.path.join(output_path, 'srs', file_name) + + # add research object + RESEARCH_SITE_BASE = 'https://research.splunk.com/' + research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/" + obj.tags.research_site_url = research_site_url body = FindingReportObject.writeFindingReport(obj) @@ -53,7 +59,8 @@ class ObjToYmlAdapter(Adapter): "risk_severity": True, "risk_score": True, "security_domain": True, - "required_fields": True + "required_fields": True, + "research_site_url": True }, "test": { @@ -86,7 +93,6 @@ class ObjToYmlAdapter(Adapter): f.write(data) f.close() - def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None: if type == SecurityContentType.detections: file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product'])) diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index f0813ee8ba..6569156817 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -46,6 +46,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index cf50f2edcc..b97e58523b 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -55,6 +55,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 2cfaca6e36..91351c5140 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -54,6 +54,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 444dc103ae..55124fcc46 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,6 +50,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 8613482410..a641bac103 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -47,6 +47,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 9d6a6d9d0e..723fb37720 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 7e6dbad662..17c5a937c6 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -53,6 +53,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 71f24d112a..4abed4382d 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index e2323fffa2..72227dde47 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -52,6 +52,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 275dd6d3f3..d5a54d0619 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -57,6 +57,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index d2cac833f6..90fcf77928 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -54,6 +54,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 7a4b6a8764..98a1f181e7 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 7a6cef077e..050c17c188 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -46,6 +46,7 @@ tags: risk_score: 54 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 1c3841d8e4..d6dc21e7de 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index e0a9b5940e..74d6688ac3 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -47,6 +47,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index f065ba01e8..7527d8b6fb 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -54,6 +54,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e9bdbb058..e865a128fb 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -53,6 +53,7 @@ tags: risk_score: 64 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 58c8d956f7..bd10fa95d5 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -63,6 +63,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 380636d2fd..ceaf466082 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -249,6 +249,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 12916987b5..6fa1179c6e 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -51,6 +51,7 @@ tags: risk_score: 15 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index ff2f683048..8017f3c543 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -55,6 +55,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index f94fc8ee9c..287252279e 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -51,6 +51,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 27e0401c36..abee8d7d9f 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -58,6 +58,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 63aaef432f..c19ba4c5bf 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -65,6 +65,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67ebe38322..c95b23c276 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -59,6 +59,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 759614f3db..1b1445dda9 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -56,6 +56,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index f7e4f65f4b..a2aa277852 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -57,6 +57,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 5fcfaa9bec..eb828d2278 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -65,6 +65,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index a4455e1b05..9b2b8918ab 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -45,6 +45,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index b146bf22e9..e3b3f5e002 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -50,6 +50,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index cd5d7489ac..0725a19f4f 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -77,6 +77,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 78b17f39a6..2e538f0486 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -59,6 +59,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index c722f05199..3c745c91b3 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,6 +88,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 018887b7e8..ad74833f85 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 065c2c4c90..cdf152b32b 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -58,6 +58,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 783f2f883f..902ff24976 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9493f8dce5..b26ef34d3c 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -64,6 +64,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 1e640f6906..783ee2a239 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -58,6 +58,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index dbd60b9417..ac16322b40 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -57,6 +57,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 3ad2da43fc..0042ab9b8b 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index f42b9a9af2..dade0a7c34 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -45,6 +45,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 88a090bba3..cb18a878e5 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -59,6 +59,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 801886f472..07f64c8c90 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index afdfddbbfa..ca34125c3a 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: From 0fb17dd6172c13fd4390a29f1b6f83ef892201f1 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 4 Aug 2022 09:28:56 +0200 Subject: [PATCH 08/10] bug fix --- .../lookups/windows_protocol_handlers.csv | 205 ++++++++++++++++++ .../obj_to_json_adapter_data/baselines.json | 2 +- .../baselines_ref.json | 2 +- .../obj_to_json_adapter_data/detections.json | 3 +- .../response_tasks.json | 2 +- .../response_tasks_ref.json | 2 +- .../obj_to_json_adapter_data/stories.json | 2 +- 7 files changed, 211 insertions(+), 7 deletions(-) create mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/windows_protocol_handlers.csv diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/windows_protocol_handlers.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/windows_protocol_handlers.csv new file mode 100644 index 0000000000..4f809b8b61 --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/windows_protocol_handlers.csv @@ -0,0 +1,205 @@ +handler,ishandler +"*bingmaps:*",TRUE +"*calculator:*",TRUE +"*callto:*",TRUE +"*conf:*",TRUE +"*DLNA-PLAYSINGLE:*",TRUE +"*Explorer.AssocActionId.BurnSelection:*",TRUE +"*Explorer.AssocActionId.EraseDisc:*",TRUE +"*Explorer.AssocActionId.ZipSelection:*",TRUE +"*Explorer.AssocProtocol.search-ms:*",TRUE +"*Explorer.BurnSelection:*",TRUE +"*Explorer.EraseDisc:*",TRUE +"*Explorer.ZipSelection:*",TRUE +"*feed:*",TRUE +"*feeds:*",TRUE +"*file:*",TRUE +"*FirefoxURL-308046B0AF4A39CB:*",TRUE +"*ftp:*",TRUE +"*grvopen:*",TRUE +"*http:*",TRUE +"*https:*",TRUE +"*iehistory:*",TRUE +"*ierss:*",TRUE +"*im:*",TRUE +"*LDAP:*",TRUE +"*Lync15:*",TRUE +"*Lync15classic:*",TRUE +"*ma-chan:*",TRUE +"*ma-filelink:*",TRUE +"*mailto:*",TRUE +"*mapi:*",TRUE +"*mapi15:*",TRUE +"*mapi16:*",TRUE +"*mk:*",TRUE +"*MMS:*",TRUE +"*ms-access:*",TRUE +"*ms-actioncenter:*",TRUE +"*ms-apprep:*",TRUE +"*ms-availablenetworks:*",TRUE +"*ms-cortana:*",TRUE +"*ms-cxh:*",TRUE +"*ms-device-enrollment:*",TRUE +"*ms-excel:*",TRUE +"*ms-msdt:*",TRUE +"*ms-penworkspace:*",TRUE +"*ms-powerpoint:*",TRUE +"*ms-publisher:*",TRUE +"*ms-settings:*",TRUE +"*ms-settings-airplanemode:*",TRUE +"*ms-settings-bluetooth:*",TRUE +"*ms-settings-cellular:*",TRUE +"*ms-settings-connectabledevices:*",TRUE +"*ms-settings-displays-topology:*",TRUE +"*ms-settings-emailandaccounts:*",TRUE +"*ms-settings-language:*",TRUE +"*ms-settings-location:*",TRUE +"*ms-settings-lock:*",TRUE +"*ms-settings-mobilehotspot:*",TRUE +"*ms-settings-notifications:*",TRUE +"*ms-settings-power:*",TRUE +"*ms-settings-privacy:*",TRUE +"*ms-settings-proximity:*",TRUE +"*ms-settings-screenrotation:*",TRUE +"*ms-settings-wifi:*",TRUE +"*ms-settings-workplace:*",TRUE +"*ms-teams:*",TRUE +"*ms-windows-search:*",TRUE +"*ms-word:*",TRUE +"*mssharepointclient:*",TRUE +"*msteams:*",TRUE +"*mswindowsmusic:*",TRUE +"*mswindowsvideo:*",TRUE +"*odopen:*",TRUE +"*OneIndex16:*",TRUE +"*OneNote:*",TRUE +"*OneNote.URL.16:*",TRUE +"*OneNoteDesktop:*",TRUE +"*OneNoteDesktop.URL.16:*",TRUE +"*Outlook.URL.feed.15:*",TRUE +"*Outlook.URL.mailto.15:*",TRUE +"*Outlook.URL.stssync.15:*",TRUE +"*Outlook.URL.webcal.15:*",TRUE +"*res:*",TRUE +"*rlogin:*",TRUE +"*search:*",TRUE +"*search-ms:*",TRUE +"*sip:*",TRUE +"*sips:*",TRUE +"*skypecast15:*",TRUE +"*stssync:*",TRUE +"*tbauth:*",TRUE +"*tel:*",TRUE +"*telnet:*",TRUE +"*tn3270:*",TRUE +"*webcal:*",TRUE +"*webcals:*",TRUE +"*windows.tbauth:*",TRUE +"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE +"*WMP11.AssocProtocol.MMS:*",TRUE +"*Word:*",TRUE +"*xbox-tcui:*",TRUE +"*appinstaller.oauth2:*",TRUE +"*bingnews:*",TRUE +"*bingweather:*",TRUE +"*feedback-hub:*",TRUE +"*git-client:*",TRUE +"*IE.HTTP:*",TRUE +"*insiderhub:*",TRUE +"*microsoft-edge:*",TRUE +"*microsoft-edge-holographic:*",TRUE +"*microsoft.windows.camera:*",TRUE +"*microsoft.windows.camera.multipicker:*",TRUE +"*microsoft.windows.camera.picker:*",TRUE +"*microsoft.windows.photos.crop:*",TRUE +"*microsoft.windows.photos.picker:*",TRUE +"*microsoft.windows.photos.videoedit:*",TRUE +"*Microsoft.Workfolders:*",TRUE +"*microsoftvideo:*",TRUE +"*ms-aad-brokerplugin:*",TRUE +"*ms-appinstaller:*",TRUE +"*ms-calculator:*",TRUE +"*ms-clock:*",TRUE +"*ms-contact-support:*",TRUE +"*ms-cortana2:*",TRUE +"*ms-cxh-full:*",TRUE +"*ms-default-location:*",TRUE +"*ms-device-enrollment2:*",TRUE +"*ms-drive-to:*",TRUE +"*ms-edu-secureassessment:*",TRUE +"*ms-eyecontrolspeech:*",TRUE +"*ms-gamebar:*",TRUE +"*ms-gamebarservices:*",TRUE +"*ms-gamingoverlay:*",TRUE +"*ms-get-started:*",TRUE +"*ms-getoffice:*",TRUE +"*ms-inputapp:*",TRUE +"*ms-insights:*",TRUE +"*ms-meetnow:*",TRUE +"*ms-meetnowflyout:*",TRUE +"*ms-mmsys:*",TRUE +"*ms-msime-imepad:*",TRUE +"*ms-msime-imjpdct:*",TRUE +"*ms-officeapp:*",TRUE +"*ms-officecmd:*",TRUE +"*ms-oobenetwork:*",TRUE +"*ms-people:*",TRUE +"*ms-perception-simulation:*",TRUE +"*ms-phone:*",TRUE +"*ms-photos:*",TRUE +"*ms-powerautomate:*",TRUE +"*ms-print-addprinter:*",TRUE +"*ms-print-printjobs:*",TRUE +"*ms-quick-assist:*",TRUE +"*ms-rdx-document:*",TRUE +"*ms-retaildemo-launchbioenrollment:*",TRUE +"*ms-retaildemo-launchstart:*",TRUE +"*ms-screenclip:*",TRUE +"*ms-screensketch:*",TRUE +"*ms-search:*",TRUE +"*ms-sttoverlay:*",TRUE +"*ms-taskswitcher:*",TRUE +"*ms-to-do:*",TRUE +"*ms-todo:*",TRUE +"*ms-unistore-email:*",TRUE +"*ms-virtualtouchpad:*",TRUE +"*ms-walk-to:*",TRUE +"*ms-wcrv:*",TRUE +"*ms-windows-store:*",TRUE +"*ms-windows-store-deskext:*",TRUE +"*ms-windows-store2:*",TRUE +"*ms-wpc:*",TRUE +"*ms-wpdrmv:*",TRUE +"*ms-wxh:*",TRUE +"*ms-xbet-survey:*",TRUE +"*ms-xbl-3d8b930f:*",TRUE +"*ms-xgpueject:*",TRUE +"*msgamepass:*",TRUE +"*msgamingapp:*",TRUE +"*msnews:*",TRUE +"*msnnews:*",TRUE +"*msnweather:*",TRUE +"*msxbox:*",TRUE +"*outlookaccounts:*",TRUE +"*outlookcal:*",TRUE +"*outlookmail:*",TRUE +"*read:*",TRUE +"*vscode:*",TRUE +"*vsls:*",TRUE +"*vstfs:*",TRUE +"*vsweb:*",TRUE +"*windows-feedback:*",TRUE +"*windowsdefender:*",TRUE +"*xboxliveapp-1297287741:*",TRUE +"*zune:*",TRUE +"*SecureBrowser.security.getDeviceInfo:*",TRUE +"*SecureBrowser.security.getMACAddress:*",TRUE +"*SecureBrowser.security.examineProcessList:*",TRUE +"*SecureBrowser.security.isRemoteSession:*",TRUE +"*SecureBrowser.security.isVMSession:*",TRUE +"*JavaScript:*",TRUE +"*vbscript:*",TRUE +"*about:*",TRUE +"*ms-its:*",TRUE +"*its:*",TRUE +"*mk:@MSITStore:*",TRUE \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json index fff623f0ad..aa656a9850 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json @@ -1 +1 @@ -{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file +{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json index fff623f0ad..aa656a9850 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json @@ -1 +1 @@ -{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file +{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json index a425d4300b..4b16d3b1d2 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json @@ -1,2 +1 @@ - -{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/private/tmp/pytest/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]} \ No newline at end of file +{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/p4t12ick/projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection", "providing_technologies": ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json index 676e93489a..78631ceb29 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json @@ -1 +1 @@ -{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file +{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json index 676e93489a..78631ceb29 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json @@ -1 +1 @@ -{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file +{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index 0f76adfa16..973eb779f3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -1 +1 @@ -{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]} \ No newline at end of file +{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]} \ No newline at end of file From 97bc95f773653387291a467d80cfb9fcf40e595f Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 4 Aug 2022 14:55:21 +0200 Subject: [PATCH 09/10] bug fix --- .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: From fe394aa85c5921f089085913e7249978bd517d2c Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 9 Aug 2022 13:03:53 +0200 Subject: [PATCH 10/10] fix-clean-obj-name --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 88a9dcb2c6..14cce5e19f 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -23,7 +23,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from