diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index d72ea30fe9..94b9c46faa 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -52,3 +52,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 890bb0292a..984050029e 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -52,3 +52,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 28634b0150..4285216919 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -51,3 +51,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 989bb599be..0d61798cc0 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -55,3 +55,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index b65e641d1a..62c7aa1f3e 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -53,3 +53,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index f61e5c188d..6f1821a10e 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -52,3 +52,20 @@ tags: - Filesystem.file_name - Filesystem.dest security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source:endpoint + - stage: privilege escalation + message: A suspicious file modification or replace in $file_path$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: file_path + type: file_path + role: + - Attacker diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 3ce21dd7be..055a290e88 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -48,3 +48,20 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 4e5a50429f..23240b8e1c 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -46,3 +46,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 00f168f112..0abbb65803 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -52,3 +52,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source:endpoint + - stage: recon + message: A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 985ce97c1c..4cd6dd3c7c 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -56,3 +56,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: recon + message: A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index d24d96b6a3..1b2f4207e2 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -56,3 +56,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index 24e146febb..dd45d3db34 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -55,3 +55,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index aab9f0b6b8..2a880ca577 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -47,3 +47,20 @@ tags: - User - Score security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 29267de07f..70f8486b2b 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -51,3 +51,21 @@ tags: - Computer - EventCode security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + - Privilege Escalation + message: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 842a7805d4..19ee848a96 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -50,3 +50,21 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + - Persistence + message: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 133a5e78e5..17cb92ef1a 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -46,3 +46,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index ecb24c758d..eb39b7e60b 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -49,3 +49,20 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Impact + message: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 1ac2e4fbcf..41597bf971 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -60,3 +60,20 @@ tags: - Filesystem.file_hash - Filesystem.user security_domain: network + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Initial Access + message: A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 20c35f71cd..06f68cfd81 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -51,3 +51,20 @@ tags: - result - _time security_domain: endpoint + impact: 60 + confidence: 100 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Credential Access + message: A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 7ee148c766..d8b0a0e3bd 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -54,3 +54,20 @@ tags: - Processes.dest - Processes.process_name security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage: Execution + message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index dfff9c0be0..e8d45fdee3 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -46,3 +46,20 @@ tags: - Processes.process - Processes.process_id security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index b82217f196..dba1a94f06 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -54,3 +54,20 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index a66be16155..c7248fef61 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -48,3 +48,20 @@ tags: - Image - user security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - source:endpoint + - stage: Impact + message: A high frequency file creation of $file_name$ in different file path in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index b8a48d8e80..29e6847c22 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -47,3 +47,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Reconnaissance + message: A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index dfcfbd8a9a..9791b839da 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -48,3 +48,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 75 + confidence: 80 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Reconnaissance + message: A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index a37c5aea78..b99c6c5889 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -60,3 +60,22 @@ tags: - Processes.process_id - Processes.dest security_domain: endpoint + impact: 75 + confidence: 60 + # (impact * confidence)/100 + risk_score: 45 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + - Defense Evasion + message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 33f0d5de1f..62c3182535 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -48,3 +48,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A registry activity in $registry_path$ related to shim modication in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 693447fe95..c1ddadd9a9 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -61,3 +61,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A registry activity in $registry_path$ related to persistence in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 970bc182ac..89755fc672 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -53,3 +53,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A registry activity in $registry_path$ related to privilege escalation in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 74922eb617..f09e4bc334 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -55,3 +55,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 142ca96a90..a723ccab64 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -59,3 +59,20 @@ tags: - Processes.parent_process_id - Processes.process_id security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $process$ contain node commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 88d00108a5..9a47e02081 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -53,3 +53,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source:endpoint + - stage: Impact + message: A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index cd7f3d85dc..1a782d54e0 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -50,3 +50,20 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 60 + confidence: 90 + # (impact * confidence)/100 + risk_score: 54 + context: + - source:endpoint + - stage: Execution + message: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 9c43f53a5d..ed9302136e 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -48,3 +48,20 @@ tags: - Registry.registry_path - Registry.registry_key_name security_domain: endpoint + impact: 60 + confidence: 100 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Defense Evasion + message: A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 1108290993..747034764e 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -56,4 +56,22 @@ tags: - parent_process_name - dest_port - process_path + - Processes.dest security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + message: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Attacker diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 7e143128e2..84e753dd6a 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -52,3 +52,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + message: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 73ccf05ea2..4659d0ee43 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -44,3 +44,20 @@ tags: - Filesystem.dest - Filesystem.user security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Impact + message: A creation of ryuk test file $file_path$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 02dda88cfa..cf0d09ab6f 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -55,3 +55,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + message: A process $process_name$ with wake on LAN commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 98742610b0..aa76311d81 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -46,3 +46,20 @@ tags: - Filesystem.file_name - Filesystem.file_path security_domain: endpoint + impact: 60 + confidence: 20 + # (impact * confidence)/100 + risk_score: 12 + context: + - source:endpoint + - stage: Impact + message: A samsam ransomware test file creation in $file_path$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 5449991567..c6c5fa19b2 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -59,3 +59,21 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 779e75f541..1cee39da4d 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -54,3 +54,22 @@ tags: - Hidden - Arguments security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Arguments + type: Arguments + role: + - Attacker diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 2a393dc98d..c2e36e450e 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -56,3 +56,20 @@ tags: - Hidden - Arguments security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + message: A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Arguments + type: Arguments + role: + - Attacker diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 7291e4a0dd..2d9379c71e 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -51,3 +51,22 @@ tags: - Processes.parent_process_name - Processes.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 42b3731f99..d9069d95a0 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -47,3 +47,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 449d8add05..d5a9bfbd24 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -51,3 +51,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 86ffdcc0d3..41791eedee 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -48,3 +48,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index e807dbf4c8..93157bf846 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -49,3 +49,20 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $process_name$ taht execute script in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 933bb0a662..d7fcfe398f 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -51,3 +51,21 @@ tags: - dest_port - process_path security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + - Privilege Escalation + message: A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Attacker diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 6fa39d9a41..c455c3613b 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -45,7 +45,25 @@ tags: - Processes.process - Processes.parent_process_name - Processes.parent_process - - Processes.dest Processes.user + - Processes.dest + - Processes.user - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage: Credential Access + message: A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index 68ad6ac3da..fe166aca87 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -57,3 +57,21 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Privilege Escalation + - Defense Evasion + message: A service process $parent_process_name$ with process path $process_path$ in host $dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 5fa61fe30d..886bcdb0b3 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -53,3 +53,20 @@ tags: - Registry.registry_value_name - Registry.dest security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: Execution + message: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: registry_path + type: RegistryPath + role: + - Others diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 6858157758..912e0e950b 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -49,3 +49,21 @@ tags: - Filesystem.file_name - Filesystem.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A process that possibly write shim database in $file_path$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: file_path + type: file path + role: + - Others diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 59318c5087..d5027553cc 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -49,3 +49,21 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A process $process_name$ that possible create a shim db silently in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 81a9ef2239..4a0bad0cf3 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -46,3 +46,20 @@ tags: - All_Changes.user - All_Changes.dest security_domain: access + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Persistence + message: A user account created or delete shortly in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 826f6d6855..0f0a908523 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -49,3 +49,20 @@ tags: - Processes.process - Processes.process_name security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + message: A suspicious process $process_name$ with single letter in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 6b145f4359..e239ff1d13 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -54,3 +54,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + message: A slui process $process_name$ with elevated commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index ad24b7c016..5c15257a3d 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -52,3 +52,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + message: A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index fd7a4f7d52..0aa76b68b3 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -49,3 +49,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 0baf036de5..9e5fee2c8a 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -58,3 +58,20 @@ tags: - process risk_severity: low security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - source:endpoint + - stage: Defense Evasion + message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 60bbb7e39e..2377ab6219 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -49,3 +49,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index dd384c8f64..b2f7d5e1c0 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -52,3 +52,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 973a926295..d64f5316ab 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -257,3 +257,20 @@ tags: - process_path risk_severity: low security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 9dc4ddb0b6..30b886ab6a 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -71,3 +71,20 @@ tags: - process_name risk_severity: low security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage: Defense Evasion + message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 3ec5e66803..b1013bda34 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -52,3 +52,20 @@ tags: - process risk_severity: low security_domain: endpoint + impact: 30 + confidence: 40 + # (impact * confidence)/100 + risk_score: 12 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index ebf3548b14..05f842f0b0 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -53,3 +53,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index ce8612550c..86a624ba0c 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -50,3 +50,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index ac31e30b59..152ab00f68 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -42,3 +42,21 @@ tags: - Signature - Signed security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: ImageLoaded + role: + - Attacker diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index e86301192a..2eb0a6eb5c 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -80,3 +80,20 @@ tags: - DNS.query - host security_domain: network + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Initial Access + message: A dns query $query$ from your infra connecting to suspicious domain in host $host$ + observable: + - name: host + type: Hostname + role: + - Victim + - name: query + type: dnsquery + role: + - Attacker diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 5748355bb6..49afe7914a 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -46,3 +46,20 @@ tags: - _time - DNS.query security_domain: network + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ + observable: + - name: host + type: Hostname + role: + - Victim + - name: query + type: dnsquery + role: + - Attacker \ No newline at end of file diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 5680b6cebb..0bb74b7335 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -56,4 +56,22 @@ tags: - bytes_out - archive_hdr1 - archive_hdr2 + - form_data security_domain: network + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ + observable: + - name: uri_path + type: UriPath + role: + - Attacker + - name: form_data + type: formdata + role: + - Attacker diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 540090ea25..27609ded27 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -45,3 +45,21 @@ tags: - bytes_in - bytes_out security_domain: network + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ + observable: + - name: uri_path + type: UriPath + role: + - Attacker + - name: form_data + type: formdata + role: + - Attacker +