From 02c9da2e07a51339ff7842c1fe6fd88baf7c5ab8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Jul 2021 10:13:42 +0200 Subject: [PATCH 01/15] rba task --- .../office_product_spawning_bitsadmin.yml | 17 ++++++++++++++++ .../office_product_spawning_certutil.yml | 17 ++++++++++++++++ .../office_product_spawning_mshta.yml | 17 ++++++++++++++++ ..._product_spawning_rundll32_with_no_dll.yml | 17 ++++++++++++++++ .../endpoint/office_product_spawning_wmic.yml | 17 ++++++++++++++++ .../overwriting_accessibility_binaries.yml | 17 ++++++++++++++++ ...mission_modification_using_takeown_app.yml | 16 +++++++++++++++ .../powershell_creating_thread_mutex.yml | 17 ++++++++++++++++ .../powershell_domain_enumeration.yml | 17 ++++++++++++++++ ...s_process_injection_via_getprocaddress.yml | 17 ++++++++++++++++ ...script_contains_base64_encoded_content.yml | 17 ++++++++++++++++ ..._memory_via_system_reflection_assembly.yml | 17 ++++++++++++++++ .../powershell_processing_stream_of_data.yml | 17 ++++++++++++++++ ...remote_thread_to_known_windows_process.yml | 18 +++++++++++++++++ .../powershell_start_bitstransfer.yml | 18 +++++++++++++++++ ...wershell_using_memory_as_backing_store.yml | 17 ++++++++++++++++ ...nt_automatic_repair_mode_using_bcdedit.yml | 17 ++++++++++++++++ ...eating_lnk_file_in_suspicious_location.yml | 17 ++++++++++++++++ ...process_deleting_its_process_file_path.yml | 17 ++++++++++++++++ .../endpoint/process_execution_via_wmi.yml | 17 ++++++++++++++++ .../process_kill_base_on_file_path.yml | 17 ++++++++++++++++ .../endpoint/processes_launching_netsh.yml | 17 ++++++++++++++++ .../ransomware_notes_bulk_creation.yml | 17 ++++++++++++++++ .../recon_avproduct_through_pwh_or_wmi.yml | 17 ++++++++++++++++ detections/endpoint/recon_using_wmi_class.yml | 17 ++++++++++++++++ ...ulating_windows_services_registry_keys.yml | 19 ++++++++++++++++++ ...istry_keys_for_creating_shim_databases.yml | 18 +++++++++++++++++ .../registry_keys_used_for_persistence.yml | 18 +++++++++++++++++ ...try_keys_used_for_privilege_escalation.yml | 18 +++++++++++++++++ .../remote_process_instantiation_via_wmi.yml | 17 ++++++++++++++++ .../endpoint/remote_wmi_command_attempt.yml | 17 ++++++++++++++++ .../endpoint/resize_shadowstorage_volume.yml | 17 ++++++++++++++++ .../endpoint/revil_common_exec_parameter.yml | 17 ++++++++++++++++ detections/endpoint/revil_registry_entry.yml | 17 ++++++++++++++++ ...no_command_line_arguments_with_network.yml | 18 +++++++++++++++++ .../rundll_loading_dll_by_ordinal.yml | 17 ++++++++++++++++ .../endpoint/ryuk_test_files_detected.yml | 17 ++++++++++++++++ .../endpoint/ryuk_wake_on_lan_command.yml | 17 ++++++++++++++++ .../endpoint/samsam_test_file_write.yml | 17 ++++++++++++++++ .../sc_exe_manipulating_windows_services.yml | 18 +++++++++++++++++ ...edule_task_with_http_command_arguments.yml | 19 ++++++++++++++++++ ...ule_task_with_rundll32_command_trigger.yml | 17 ++++++++++++++++ ...eduled_task_deleted_or_created_via_cmd.yml | 19 ++++++++++++++++++ .../endpoint/schtasks_run_task_on_demand.yml | 19 ++++++++++++++++++ ...htasks_scheduling_job_on_remote_system.yml | 19 ++++++++++++++++++ .../schtasks_used_for_forcing_a_reboot.yml | 19 ++++++++++++++++++ .../endpoint/script_execution_via_wmi.yml | 17 ++++++++++++++++ ...host_with_no_command_line_with_network.yml | 18 +++++++++++++++++ .../secretdumps_offline_ntds_dumping_tool.yml | 20 ++++++++++++++++++- detections/endpoint/services_escalate_exe.yml | 18 +++++++++++++++++ ...ution_policy_to_unrestricted_or_bypass.yml | 17 ++++++++++++++++ .../endpoint/shim_database_file_creation.yml | 18 +++++++++++++++++ ...nstallation_with_suspicious_parameters.yml | 18 +++++++++++++++++ .../endpoint/short_lived_windows_accounts.yml | 17 ++++++++++++++++ .../single_letter_process_on_endpoint.yml | 17 ++++++++++++++++ detections/endpoint/slui_runas_elevated.yml | 17 ++++++++++++++++ .../endpoint/slui_spawning_a_process.yml | 17 ++++++++++++++++ 57 files changed, 993 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index d72ea30fe9..1ce5e96901 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -52,3 +52,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Processes.process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 890bb0292a..b3a9abe1d7 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -52,3 +52,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Processes.process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 28634b0150..8a6a283938 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -51,3 +51,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Processes.process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 989bb599be..d19f3f9d0b 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -55,3 +55,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ and no dll commandline $Processes.process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index b65e641d1a..31f9643665 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -53,3 +53,20 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: recon + message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Processes.process_name + type: process_name + role: + - Attacker diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index f61e5c188d..92977c09dc 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -52,3 +52,20 @@ tags: - Filesystem.file_name - Filesystem.dest security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source:endpoint + - stage: privilege escalation + message: A suspicious file modification or replace in $Filesystem.file_path$ in host $Filesystem.dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Filesystem.file_path + type: file_path + role: + - Attacker diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 3ce21dd7be..d558cb3c35 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -48,3 +48,19 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 70 + confidence: 85 + # (impact * confidence)/100 + risk_score: 59.5 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious of execution of $Processes.process_name$ with process id $Processes.process_id$ and commandline $Processes.process$ to modify permission of directory or files in host $Processes.dest$ + observable: + - name: + type: Hostname + role: + - Victim + - name: dest + type: Hostname + role: diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 4e5a50429f..23240b8e1c 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -46,3 +46,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 00f168f112..0abbb65803 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -52,3 +52,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source:endpoint + - stage: recon + message: A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 985ce97c1c..4cd6dd3c7c 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -56,3 +56,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: recon + message: A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index d24d96b6a3..1b2f4207e2 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -56,3 +56,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index 24e146febb..dd45d3db34 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -55,3 +55,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index aab9f0b6b8..2a880ca577 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -47,3 +47,20 @@ tags: - User - Score security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 29267de07f..70f8486b2b 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -51,3 +51,21 @@ tags: - Computer - EventCode security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + - Privilege Escalation + message: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 842a7805d4..41cb6ed0ed 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -50,3 +50,21 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + - Persistence + message: A suspicious process $Processes.process_name$ with commandline $Processes.process$ that are related to bittransfer functionality in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 133a5e78e5..17cb92ef1a 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -46,3 +46,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - source:endpoint + - stage: Defense Evasion + message: A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index ecb24c758d..085df3b9fc 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -49,3 +49,20 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 70 + confidence: 85 + # (impact * confidence)/100 + risk_score: 59.5 + context: + - source:endpoint + - stage: Impact + message: A suspicious process $Processes.process_name$ with process id $Processes.process_id$ contains commandline $Processes.process$ to ignore all bcdedit execution failure in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 1ac2e4fbcf..8227cafe18 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -60,3 +60,20 @@ tags: - Filesystem.file_hash - Filesystem.user security_domain: network + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Initial Access + message: A process $Processes.process_name$ that launching .lnk file in $Filesystem.file_path$ in host $dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Filesystem.user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 20c35f71cd..06f68cfd81 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -51,3 +51,20 @@ tags: - result - _time security_domain: endpoint + impact: 60 + confidence: 100 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Credential Access + message: A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 7ee148c766..cd08c662c3 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -54,3 +54,20 @@ tags: - Processes.dest - Processes.process_name security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage: Execution + message: A remote instance execution of wmic.exe that will spawn $Processes.parent_process_name$ in host Processes.dest + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index dfff9c0be0..965788b2cd 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -46,3 +46,20 @@ tags: - Processes.process - Processes.process_id security_domain: endpoint + impact: 70 + confidence: 75 + # (impact * confidence)/100 + risk_score: 52.5 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $Processes.process_name$ attempt to kill process by its file path using commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index b82217f196..66efecf75a 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -54,3 +54,20 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $Processes.process_name$ that tries to execute netsh commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index a66be16155..c7248fef61 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -48,3 +48,20 @@ tags: - Image - user security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - source:endpoint + - stage: Impact + message: A high frequency file creation of $file_name$ in different file path in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index b8a48d8e80..a1dfa60e60 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -47,3 +47,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 70 + confidence: 85 + # (impact * confidence)/100 + risk_score: 59.5 + context: + - source:endpoint + - stage: Reconnaissance + message: A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index dfcfbd8a9a..9791b839da 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -48,3 +48,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 75 + confidence: 80 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Reconnaissance + message: A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index a37c5aea78..ba78e26089 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -60,3 +60,22 @@ tags: - Processes.process_id - Processes.dest security_domain: endpoint + impact: 75 + confidence: 60 + # (impact * confidence)/100 + risk_score: 45 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + - Defense Evasion + message: A reg.exe process $Processes.process_name$ with commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 33f0d5de1f..f978b56eeb 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -48,3 +48,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A registry activity in $Registry.registry_path$ related to shim modication in host $Registry.dest$ + observable: + - name: Registry.dest + type: Hostname + role: + - Victim + - name: Registry.user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 693447fe95..dae2cb1d61 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -61,3 +61,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A registry activity in $Registry.registry_path$ related to persistence in host $Registry.dest$ + observable: + - name: Registry.dest + type: Hostname + role: + - Victim + - name: Registry.user + type: user + role: + - Victim diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 970bc182ac..e0c427eb74 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -53,3 +53,21 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A registry activity in $Registry.registry_path$ related to privilege escalation in host $Registry.dest$ + observable: + - name: Registry.dest + type: Hostname + role: + - Victim + - name: Registry.user + type: user + role: + - Victim diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 74922eb617..c5fdad9ff7 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -55,3 +55,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 75 + # (impact * confidence)/100 + risk_score: 52.5 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $Processes.process$ contain process spawn commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 142ca96a90..f81bdd0ec5 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -59,3 +59,20 @@ tags: - Processes.parent_process_id - Processes.process_id security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $Processes.process$ contain node commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 88d00108a5..b334f225aa 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -53,3 +53,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source:endpoint + - stage: Impact + message: A process $Processes.parent_process_name$ attempt to resize shadow copy with commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index cd7f3d85dc..c572550f6b 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -50,3 +50,20 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 60 + confidence: 90 + # (impact * confidence)/100 + risk_score: 54 + context: + - source:endpoint + - stage: Execution + message: A process $Processes.process_name$ with commandline $Processes.process$ related to revil ransomware in host Processes.dest + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 7690d913aa..713d9b86c6 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -47,3 +47,20 @@ tags: - Registry.registry_path - Registry.registry_key_name security_domain: endpoint + impact: 60 + confidence: 100 + # (impact * confidence)/100 + risk_score: 60 + context: + - source:endpoint + - stage: Defense Evasion + message: A registry entry $Registry.registry_path$ with registry value $Registry.registry_value_name$ and $Registry.registry_value_name$ related to revil ransomware in host $Registry.dest$ + observable: + - name: Registry.dest + type: Hostname + role: + - Victim + - name: Registry.user + type: user + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 1108290993..51162e4a77 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -56,4 +56,22 @@ tags: - parent_process_name - dest_port - process_path + - Processes.dest security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + message: A rundll32 process $Processes.process_name$ with no commandline argument like this process commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Attacker diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 7e143128e2..d7ef794fb2 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -52,3 +52,20 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + message: A rundll32 process $Processes.process_name$ with ordinal parameter like this process commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 73ccf05ea2..3e159d7485 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -44,3 +44,20 @@ tags: - Filesystem.dest - Filesystem.user security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Impact + message: A creation of ryuk test file $Filesystem.file_path$ in host $Filesystem.dest$ + observable: + - name: Filesystem.dest + type: Hostname + role: + - Victim + - name: Filesystem.user + type: user + role: + - Victim diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 02dda88cfa..d0d611f292 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -55,3 +55,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 95 + # (impact * confidence)/100 + risk_score: 66.5 + context: + - source:endpoint + - stage: Execution + message: A process $Processes.process_name$ with wake on LAN commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 98742610b0..c2ff4872bb 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -46,3 +46,20 @@ tags: - Filesystem.file_name - Filesystem.file_path security_domain: endpoint + impact: 60 + confidence: 20 + # (impact * confidence)/100 + risk_score: 12 + context: + - source:endpoint + - stage: Impact + message: A samsam ransomware test file creation in $Filesystem.file_path$ in host $Filesystem.dest$ + observable: + - name: Filesystem.dest + type: Hostname + role: + - Victim + - name: Filesystem.user + type: user + role: + - Victim diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 5449991567..fd077b20b4 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -59,3 +59,21 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 85 + # (impact * confidence)/100 + risk_score: 59.5 + context: + - source:endpoint + - stage: Persistence + - Privilege Escalation + message: A sc process $Processes.process_name$ with commandline $Processes.process$ to create of configure services in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 779e75f541..1cee39da4d 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -54,3 +54,22 @@ tags: - Hidden - Arguments security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Arguments + type: Arguments + role: + - Attacker diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 2a393dc98d..af151a8c5b 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -56,3 +56,20 @@ tags: - Hidden - Arguments security_domain: endpoint + impact: 70 + confidence: 95 + # (impact * confidence)/100 + risk_score: 66.5 + context: + - source:endpoint + - stage: Defense Evasion + message: A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Arguments + type: Arguments + role: + - Attacker diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 7291e4a0dd..92349c9e8f 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -51,3 +51,22 @@ tags: - Processes.parent_process_name - Processes.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $Processes.process_name$ with create or delete commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 42b3731f99..dffb5426c6 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -47,3 +47,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A "on demand" execution of schedule task process $Processes.process_name$ using commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 449d8add05..5cd8e99bb5 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -51,3 +51,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $Processes.process_name$ with remote job commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 86ffdcc0d3..5f6a85431c 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -48,3 +48,22 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Execution + - Persistence + - Privilege Escalation + message: A schedule task process $Processes.process_name$ with force reboot commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index e807dbf4c8..5316b016c1 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -49,3 +49,20 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - source:endpoint + - stage: Execution + message: A wmic.exe process $Processes.process_name$ taht execute script in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 933bb0a662..cba710ce5c 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -51,3 +51,21 @@ tags: - dest_port - process_path security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source:endpoint + - stage: Defense Evasion + - Privilege Escalation + message: A searchprotocolhost.exe process $Processes.process_name$ with no commandline in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Attacker diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 6fa39d9a41..aae26ebd2d 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -45,7 +45,25 @@ tags: - Processes.process - Processes.parent_process_name - Processes.parent_process - - Processes.dest Processes.user + - Processes.dest + - Processes.user - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage: Credential Access + message: A secretdump process $Processes.process_name$ with secretdump commandline $Processes.process$ to dump credentials in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index 68ad6ac3da..2a9b262aa9 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -57,3 +57,21 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 95 + # (impact * confidence)/100 + risk_score: 76 + context: + - source:endpoint + - stage: Privilege Escalation + - Defense Evasion + message: A service process $Processes.parent_process_name$ with process path $Processes.process_path$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 5fa61fe30d..bceea27ca2 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -53,3 +53,20 @@ tags: - Registry.registry_value_name - Registry.dest security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - source:endpoint + - stage: Execution + message: A registry modification in $Registry.registry_path$ with reg key $Registry.registry_key_name$ and reg value $Registry.registry_value_name$ in host $Registry.dest$ + observable: + - name: Registry.dest + type: Hostname + role: + - Victim + - name: Registry.registry_path + type: RegistryPath + role: + - Others diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 6858157758..d95c91a2ae 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -49,3 +49,21 @@ tags: - Filesystem.file_name - Filesystem.dest security_domain: endpoint + impact: 70 + confidence: 85 + # (impact * confidence)/100 + risk_score: 59.5 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A process that possibly write shim database in $Filesystem.file_path$ in host $Filesystem.dest$ + observable: + - name: Filesystem.dest + type: Hostname + role: + - Victim + - name: Filesystem.file_path + type: file path + role: + - Others diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 59318c5087..9ec6c0e088 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -49,3 +49,21 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A process $Processes.process_name$ that possible create a shim db silently in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 81a9ef2239..0fe93eec3b 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -46,3 +46,20 @@ tags: - All_Changes.user - All_Changes.dest security_domain: access + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Persistence + message: A user account created or delete shortly in host $All_Changes.dest$ + observable: + - name: All_Changes.dest + type: Hostname + role: + - Victim + - name: All_Changes.user + type: user + role: + - Victim diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 826f6d6855..1d7d1a6271 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -49,3 +49,20 @@ tags: - Processes.process - Processes.process_name security_domain: endpoint + impact: 70 + confidence: 95 + # (impact * confidence)/100 + risk_score: 66.5 + context: + - source:endpoint + - stage: Execution + message: A suspicious process $Processes.process_name$ with single letter in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 6b145f4359..b6c98d91bd 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -54,3 +54,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + message: A slui process $Processes.process_name$ with elevated commandline $Processes.process$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index ad24b7c016..bc0c9106d6 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -52,3 +52,20 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Privilege Escalation + message: A slui process $Processes.parent_process_name$ spawning child process $Processes.process_name$ in host $Processes.dest$ + observable: + - name: Processes.dest + type: Hostname + role: + - Victim + - name: Processes.user + type: user + role: + - Victim From fe570f7f2f3119bc9bfebe7eb352f68b60932979 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:18:55 +0200 Subject: [PATCH 02/15] Update permission_modification_using_takeown_app.yml --- .../endpoint/permission_modification_using_takeown_app.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index d558cb3c35..f55a6291bb 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -49,9 +49,9 @@ tags: - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 85 + confidence: 80 # (impact * confidence)/100 - risk_score: 59.5 + risk_score: 56 context: - source:endpoint - stage: Defense Evasion From be71919e60c085ed90b6e82efa75a018ae14b948 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:19:24 +0200 Subject: [PATCH 03/15] Update prevent_automatic_repair_mode_using_bcdedit.yml --- .../endpoint/prevent_automatic_repair_mode_using_bcdedit.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 085df3b9fc..39e14d1f71 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -50,9 +50,9 @@ tags: - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 85 + confidence: 80 # (impact * confidence)/100 - risk_score: 59.5 + risk_score: 56 context: - source:endpoint - stage: Impact From 4f7c6ff84ddd6705f0c7dc7cd45c8fb4a454eb55 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:20:11 +0200 Subject: [PATCH 04/15] Update process_kill_base_on_file_path.yml --- detections/endpoint/process_kill_base_on_file_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 965788b2cd..d6a4a57d6d 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -47,9 +47,9 @@ tags: - Processes.process_id security_domain: endpoint impact: 70 - confidence: 75 + confidence: 80 # (impact * confidence)/100 - risk_score: 52.5 + risk_score: 56 context: - source:endpoint - stage: Defense Evasion From be0d7ef35231b551afd5794c6a965255faa598ad Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:20:56 +0200 Subject: [PATCH 05/15] Update single_letter_process_on_endpoint.yml --- detections/endpoint/single_letter_process_on_endpoint.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 1d7d1a6271..a11048a1aa 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -50,9 +50,9 @@ tags: - Processes.process_name security_domain: endpoint impact: 70 - confidence: 95 + confidence: 90 # (impact * confidence)/100 - risk_score: 66.5 + risk_score: 63 context: - source:endpoint - stage: Execution From 9ab3a3b40204b2eb200b3d367388192067e6c7d2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:21:56 +0200 Subject: [PATCH 06/15] Update recon_avproduct_through_pwh_or_wmi.yml --- detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index a1dfa60e60..29e6847c22 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -48,9 +48,9 @@ tags: - User security_domain: endpoint impact: 70 - confidence: 85 + confidence: 80 # (impact * confidence)/100 - risk_score: 59.5 + risk_score: 56 context: - source:endpoint - stage: Reconnaissance From 1ac33326229831808aa6fbed345f798f7fbc1533 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:22:31 +0200 Subject: [PATCH 07/15] Update remote_process_instantiation_via_wmi.yml --- detections/endpoint/remote_process_instantiation_via_wmi.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index c5fdad9ff7..afeabb71fd 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -56,9 +56,9 @@ tags: - Processes.user security_domain: endpoint impact: 70 - confidence: 75 + confidence: 70 # (impact * confidence)/100 - risk_score: 52.5 + risk_score: 49 context: - source:endpoint - stage: Execution From 9fb0e1bded4cd96ba194a4a5a1e5e6a8a9a9fae0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:23:00 +0200 Subject: [PATCH 08/15] Update ryuk_wake_on_lan_command.yml --- detections/endpoint/ryuk_wake_on_lan_command.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index d0d611f292..3e7c0c1a80 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -56,9 +56,9 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 70 - confidence: 95 + confidence: 90 # (impact * confidence)/100 - risk_score: 66.5 + risk_score: 63 context: - source:endpoint - stage: Execution From d7c8dc6fa7540879e154c4870caf886a663c8913 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:23:21 +0200 Subject: [PATCH 09/15] Update schedule_task_with_rundll32_command_trigger.yml --- .../endpoint/schedule_task_with_rundll32_command_trigger.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index af151a8c5b..c2e36e450e 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -57,9 +57,9 @@ tags: - Arguments security_domain: endpoint impact: 70 - confidence: 95 + confidence: 100 # (impact * confidence)/100 - risk_score: 66.5 + risk_score: 70 context: - source:endpoint - stage: Defense Evasion From 4be7e99ddbd6feaa4a1ca371b86361d0b51d151b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:23:53 +0200 Subject: [PATCH 10/15] Update shim_database_file_creation.yml --- detections/endpoint/shim_database_file_creation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index d95c91a2ae..ad1a9c0022 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -50,9 +50,9 @@ tags: - Filesystem.dest security_domain: endpoint impact: 70 - confidence: 85 + confidence: 80 # (impact * confidence)/100 - risk_score: 59.5 + risk_score: 56 context: - source:endpoint - stage: Privilege Escalation From 463c27d20fb7b9f6b6536ffa927626ba1dec067a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:25:49 +0200 Subject: [PATCH 11/15] Update sc_exe_manipulating_windows_services.yml --- detections/endpoint/sc_exe_manipulating_windows_services.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index fd077b20b4..4629395cdd 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -60,9 +60,9 @@ tags: - Processes.user security_domain: endpoint impact: 70 - confidence: 85 + confidence: 80 # (impact * confidence)/100 - risk_score: 59.5 + risk_score: 56 context: - source:endpoint - stage: Persistence From 9fc60355a1a9af7f81440baaccd5a9065ee54da9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Jul 2021 10:33:50 +0200 Subject: [PATCH 12/15] Update permission_modification_using_takeown_app.yml --- .../endpoint/permission_modification_using_takeown_app.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index f55a6291bb..bc895d5493 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -57,10 +57,11 @@ tags: - stage: Defense Evasion message: A suspicious of execution of $Processes.process_name$ with process id $Processes.process_id$ and commandline $Processes.process$ to modify permission of directory or files in host $Processes.dest$ observable: - - name: + - name: Processes.dest type: Hostname role: - Victim - - name: dest - type: Hostname + - name: Processes.user + type: user role: + - Victim From 019e9311f1b0da6b098158804bd7cdf71e33995d Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Jul 2021 16:33:48 +0200 Subject: [PATCH 13/15] rba_task_2 --- ...___deny_permission_using_cacls_utility.yml | 17 +++++++++++++++++ .../ssa___first_time_seen_cmd_line.yml | 17 +++++++++++++++++ ...__grant_permission_using_cacls_utility.yml | 17 +++++++++++++++++ ...fy_acls_permission_of_files_or_folders.yml | 17 +++++++++++++++++ ...em_process_running_unexpected_location.yml | 17 +++++++++++++++++ ...unusual_lolbas_in_short_period_of_time.yml | 17 +++++++++++++++++ .../ssa___unusually_long_command_line.yml | 17 +++++++++++++++++ .../ssa___wevtutil_usage_to_clear_logs.yml | 17 +++++++++++++++++ .../ssa___wevtutil_usage_to_disable_logs.yml | 17 +++++++++++++++++ detections/endpoint/xmrig_driver_loaded.yml | 18 ++++++++++++++++++ ...connecting_to_dynamic_domain_providers.yml | 17 +++++++++++++++++ ...ry_length_with_high_standard_deviation.yml | 19 ++++++++++++++++++- ...ltiple_archive_files_http_post_traffic.yml | 18 ++++++++++++++++++ .../plain_http_post_exfiltrated_data.yml | 18 ++++++++++++++++++ 14 files changed, 242 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index fd7a4f7d52..0aa76b68b3 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -49,3 +49,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 355cff51a4..a37082cec6 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -58,3 +58,20 @@ tags: - process risk_severity: low security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - source:endpoint + - stage: Defense Evasion + message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 60bbb7e39e..2377ab6219 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -49,3 +49,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index dd384c8f64..b2f7d5e1c0 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -52,3 +52,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - source:endpoint + - stage: Defense Evasion + message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index ca13c9e39c..f556d34758 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -256,3 +256,20 @@ tags: - process_path risk_severity: low security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Defense Evasion + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 91a6f580d2..6ceb4fdbd2 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -71,3 +71,20 @@ tags: - process_name risk_severity: low security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage: Defense Evasion + message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: process_name + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 3ec5e66803..b1013bda34 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -52,3 +52,20 @@ tags: - process risk_severity: low security_domain: endpoint + impact: 30 + confidence: 40 + # (impact * confidence)/100 + risk_score: 12 + context: + - source:endpoint + - stage: Defense Evasion + message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index ebf3548b14..05f842f0b0 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -53,3 +53,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index ce8612550c..86a624ba0c 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -50,3 +50,20 @@ tags: - dest_user_id - process security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source:endpoint + - stage: Defense Evasion + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: user + role: + - Victim diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index ac31e30b59..152ab00f68 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -42,3 +42,21 @@ tags: - Signature - Signed security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage: Privilege Escalation + - Persistence + message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: ImageLoaded + role: + - Attacker diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index e86301192a..a8693902c7 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -80,3 +80,20 @@ tags: - DNS.query - host security_domain: network + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage: Initial Access + message: A dns query $DNS.query$ from your infra connecting to suspicious domain in host $host$ + observable: + - name: host + type: Hostname + role: + - Victim + - name: DNS.query + type: dnsquery + role: + - Attacker diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 5748355bb6..6f371d8a2b 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -10,7 +10,7 @@ description: This search allows you to identify DNS requests and compute the sta deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | + by $DNS.query$ | `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` ' @@ -46,3 +46,20 @@ tags: - _time - DNS.query security_domain: network + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A dns query $DNS.query$ with 2 time standard deviation of name len of the dns query in host $host$ + observable: + - name: host + type: Hostname + role: + - Victim + - name: DNS.query + type: dnsquery + role: + - Attacker \ No newline at end of file diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 5680b6cebb..0bb74b7335 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -56,4 +56,22 @@ tags: - bytes_out - archive_hdr1 - archive_hdr2 + - form_data security_domain: network + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ + observable: + - name: uri_path + type: UriPath + role: + - Attacker + - name: form_data + type: formdata + role: + - Attacker diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 540090ea25..27609ded27 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -45,3 +45,21 @@ tags: - bytes_in - bytes_out security_domain: network + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Exfiltration + message: A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ + observable: + - name: uri_path + type: UriPath + role: + - Attacker + - name: form_data + type: formdata + role: + - Attacker + From 8477b3e3a045a6eba2341e36d8e1a7d723aa23d8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Jul 2021 16:35:10 +0200 Subject: [PATCH 14/15] rba_task_2 --- .../network/dns_query_length_with_high_standard_deviation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 6f371d8a2b..3f5c7a42d6 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -10,7 +10,7 @@ description: This search allows you to identify DNS requests and compute the sta deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - by $DNS.query$ | `drop_dm_object_name("DNS")` | eval query_length = len(query) | + by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` ' From 3d82142995797eabbb7877c5c250b685f4d135ed Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 15 Jul 2021 09:39:03 +0200 Subject: [PATCH 15/15] rba_task_update --- .../endpoint/office_product_spawning_bitsadmin.yml | 4 ++-- .../endpoint/office_product_spawning_certutil.yml | 4 ++-- .../endpoint/office_product_spawning_mshta.yml | 4 ++-- .../office_product_spawning_rundll32_with_no_dll.yml | 2 +- detections/endpoint/office_product_spawning_wmic.yml | 4 ++-- .../endpoint/overwriting_accessibility_binaries.yml | 4 ++-- .../permission_modification_using_takeown_app.yml | 12 ++++++------ .../endpoint/powershell_start_bitstransfer.yml | 6 +++--- .../prevent_automatic_repair_mode_using_bcdedit.yml | 6 +++--- ...cess_creating_lnk_file_in_suspicious_location.yml | 6 +++--- detections/endpoint/process_execution_via_wmi.yml | 6 +++--- .../endpoint/process_kill_base_on_file_path.yml | 6 +++--- detections/endpoint/processes_launching_netsh.yml | 6 +++--- ...e_manipulating_windows_services_registry_keys.yml | 6 +++--- .../registry_keys_for_creating_shim_databases.yml | 6 +++--- .../endpoint/registry_keys_used_for_persistence.yml | 6 +++--- .../registry_keys_used_for_privilege_escalation.yml | 6 +++--- .../remote_process_instantiation_via_wmi.yml | 6 +++--- detections/endpoint/remote_wmi_command_attempt.yml | 6 +++--- detections/endpoint/resize_shadowstorage_volume.yml | 6 +++--- detections/endpoint/revil_common_exec_parameter.yml | 6 +++--- detections/endpoint/revil_registry_entry.yml | 6 +++--- ...2_with_no_command_line_arguments_with_network.yml | 4 ++-- .../endpoint/rundll_loading_dll_by_ordinal.yml | 6 +++--- detections/endpoint/ryuk_test_files_detected.yml | 6 +++--- detections/endpoint/ryuk_wake_on_lan_command.yml | 6 +++--- detections/endpoint/samsam_test_file_write.yml | 6 +++--- .../sc_exe_manipulating_windows_services.yml | 6 +++--- .../scheduled_task_deleted_or_created_via_cmd.yml | 6 +++--- detections/endpoint/schtasks_run_task_on_demand.yml | 6 +++--- .../schtasks_scheduling_job_on_remote_system.yml | 2 +- .../endpoint/schtasks_used_for_forcing_a_reboot.yml | 6 +++--- detections/endpoint/script_execution_via_wmi.yml | 6 +++--- ...rotocolhost_with_no_command_line_with_network.yml | 4 ++-- .../secretdumps_offline_ntds_dumping_tool.yml | 6 +++--- detections/endpoint/services_escalate_exe.yml | 2 +- ...ll_execution_policy_to_unrestricted_or_bypass.yml | 6 +++--- detections/endpoint/shim_database_file_creation.yml | 6 +++--- ...abase_installation_with_suspicious_parameters.yml | 6 +++--- detections/endpoint/short_lived_windows_accounts.yml | 6 +++--- .../endpoint/single_letter_process_on_endpoint.yml | 6 +++--- detections/endpoint/slui_runas_elevated.yml | 6 +++--- detections/endpoint/slui_spawning_a_process.yml | 6 +++--- ..._hosts_connecting_to_dynamic_domain_providers.yml | 4 ++-- ...dns_query_length_with_high_standard_deviation.yml | 4 ++-- 45 files changed, 123 insertions(+), 123 deletions(-) diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 1ce5e96901..94b9c46faa 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -59,13 +59,13 @@ tags: context: - source:endpoint - stage: recon - message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ observable: - name: dest type: Hostname role: - Victim - - name: Processes.process_name + - name: process_name type: process_name role: - Attacker diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index b3a9abe1d7..984050029e 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -59,13 +59,13 @@ tags: context: - source:endpoint - stage: recon - message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ observable: - name: dest type: Hostname role: - Victim - - name: Processes.process_name + - name: process_name type: process_name role: - Attacker diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 8a6a283938..4285216919 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -58,13 +58,13 @@ tags: context: - source:endpoint - stage: recon - message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ observable: - name: dest type: Hostname role: - Victim - - name: Processes.process_name + - name: process_name type: process_name role: - Attacker diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index d19f3f9d0b..0d61798cc0 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -62,7 +62,7 @@ tags: context: - source:endpoint - stage: recon - message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ and no dll commandline $Processes.process$ in host $dest$ + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index 31f9643665..62c7aa1f3e 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -60,13 +60,13 @@ tags: context: - source:endpoint - stage: recon - message: office parent process $Processes.parent_process_name$ will execute a suspicious child process $Processes.process_name$ with process id $Processes.process_id$ in host $dest$ + message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ observable: - name: dest type: Hostname role: - Victim - - name: Processes.process_name + - name: process_name type: process_name role: - Attacker diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 92977c09dc..6f1821a10e 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -59,13 +59,13 @@ tags: context: - source:endpoint - stage: privilege escalation - message: A suspicious file modification or replace in $Filesystem.file_path$ in host $Filesystem.dest$ + message: A suspicious file modification or replace in $file_path$ in host $dest$ observable: - name: dest type: Hostname role: - Victim - - name: Filesystem.file_path + - name: file_path type: file_path role: - Attacker diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index bc895d5493..055a290e88 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -51,17 +51,17 @@ tags: impact: 70 confidence: 80 # (impact * confidence)/100 - risk_score: 56 + risk_score: 56 context: - source:endpoint - stage: Defense Evasion - message: A suspicious of execution of $Processes.process_name$ with process id $Processes.process_id$ and commandline $Processes.process$ to modify permission of directory or files in host $Processes.dest$ + message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user - type: user + - name: process_name + type: process name role: - - Victim + - Attacker diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 41cb6ed0ed..19ee848a96 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -58,13 +58,13 @@ tags: - source:endpoint - stage: Defense Evasion - Persistence - message: A suspicious process $Processes.process_name$ with commandline $Processes.process$ that are related to bittransfer functionality in host $Processes.dest$ + message: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim \ No newline at end of file diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 39e14d1f71..eb39b7e60b 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -56,13 +56,13 @@ tags: context: - source:endpoint - stage: Impact - message: A suspicious process $Processes.process_name$ with process id $Processes.process_id$ contains commandline $Processes.process$ to ignore all bcdedit execution failure in host $Processes.dest$ + message: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 8227cafe18..41597bf971 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -67,13 +67,13 @@ tags: context: - source:endpoint - stage: Initial Access - message: A process $Processes.process_name$ that launching .lnk file in $Filesystem.file_path$ in host $dest$ + message: A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Filesystem.user + - name: user type: user role: - Victim \ No newline at end of file diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index cd08c662c3..d8b0a0e3bd 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -61,13 +61,13 @@ tags: context: - source:endpoint - stage: Execution - message: A remote instance execution of wmic.exe that will spawn $Processes.parent_process_name$ in host Processes.dest + message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index d6a4a57d6d..e8d45fdee3 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -53,13 +53,13 @@ tags: context: - source:endpoint - stage: Defense Evasion - message: A process $Processes.process_name$ attempt to kill process by its file path using commandline $Processes.process$ in host $Processes.dest$ + message: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 66efecf75a..dba1a94f06 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -61,13 +61,13 @@ tags: context: - source:endpoint - stage: Defense Evasion - message: A process $Processes.process_name$ that tries to execute netsh commandline $Processes.process$ in host $Processes.dest$ + message: A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index ba78e26089..b99c6c5889 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -69,13 +69,13 @@ tags: - stage: Persistence - Privilege Escalation - Defense Evasion - message: A reg.exe process $Processes.process_name$ with commandline $Processes.process$ in host $Processes.dest$ + message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index f978b56eeb..62c3182535 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -56,13 +56,13 @@ tags: - source:endpoint - stage: Privilege Escalation - Persistence - message: A registry activity in $Registry.registry_path$ related to shim modication in host $Registry.dest$ + message: A registry activity in $registry_path$ related to shim modication in host $dest$ observable: - - name: Registry.dest + - name: dest type: Hostname role: - Victim - - name: Registry.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index dae2cb1d61..c1ddadd9a9 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -69,13 +69,13 @@ tags: - source:endpoint - stage: Persistence - Privilege Escalation - message: A registry activity in $Registry.registry_path$ related to persistence in host $Registry.dest$ + message: A registry activity in $registry_path$ related to persistence in host $dest$ observable: - - name: Registry.dest + - name: dest type: Hostname role: - Victim - - name: Registry.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e0c427eb74..89755fc672 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -61,13 +61,13 @@ tags: - source:endpoint - stage: Persistence - Privilege Escalation - message: A registry activity in $Registry.registry_path$ related to privilege escalation in host $Registry.dest$ + message: A registry activity in $registry_path$ related to privilege escalation in host $dest$ observable: - - name: Registry.dest + - name: dest type: Hostname role: - Victim - - name: Registry.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index afeabb71fd..f09e4bc334 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -62,13 +62,13 @@ tags: context: - source:endpoint - stage: Execution - message: A wmic.exe process $Processes.process$ contain process spawn commandline $Processes.process$ in host $Processes.dest$ + message: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index f81bdd0ec5..a723ccab64 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -66,13 +66,13 @@ tags: context: - source:endpoint - stage: Execution - message: A wmic.exe process $Processes.process$ contain node commandline $Processes.process$ in host $Processes.dest$ + message: A wmic.exe process $process$ contain node commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index b334f225aa..9a47e02081 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -60,13 +60,13 @@ tags: context: - source:endpoint - stage: Impact - message: A process $Processes.parent_process_name$ attempt to resize shadow copy with commandline $Processes.process$ in host $Processes.dest$ + message: A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index c572550f6b..1a782d54e0 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -57,13 +57,13 @@ tags: context: - source:endpoint - stage: Execution - message: A process $Processes.process_name$ with commandline $Processes.process$ related to revil ransomware in host Processes.dest + message: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index f2ee3d3ef1..ed9302136e 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -55,13 +55,13 @@ tags: context: - source:endpoint - stage: Defense Evasion - message: A registry entry $Registry.registry_path$ with registry value $Registry.registry_value_name$ and $Registry.registry_value_name$ related to revil ransomware in host $Registry.dest$ + message: A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ observable: - - name: Registry.dest + - name: dest type: Hostname role: - Victim - - name: Registry.user + - name: user type: user role: - Victim \ No newline at end of file diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 51162e4a77..747034764e 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -65,9 +65,9 @@ tags: context: - source:endpoint - stage: Defense Evasion - message: A rundll32 process $Processes.process_name$ with no commandline argument like this process commandline $Processes.process$ in host $Processes.dest$ + message: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index d7ef794fb2..84e753dd6a 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -59,13 +59,13 @@ tags: context: - source:endpoint - stage: Defense Evasion - message: A rundll32 process $Processes.process_name$ with ordinal parameter like this process commandline $Processes.process$ in host $Processes.dest$ + message: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 3e159d7485..4659d0ee43 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -51,13 +51,13 @@ tags: context: - source:endpoint - stage: Impact - message: A creation of ryuk test file $Filesystem.file_path$ in host $Filesystem.dest$ + message: A creation of ryuk test file $file_path$ in host $dest$ observable: - - name: Filesystem.dest + - name: dest type: Hostname role: - Victim - - name: Filesystem.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 3e7c0c1a80..cf0d09ab6f 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -62,13 +62,13 @@ tags: context: - source:endpoint - stage: Execution - message: A process $Processes.process_name$ with wake on LAN commandline $Processes.process$ in host $Processes.dest$ + message: A process $process_name$ with wake on LAN commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index c2ff4872bb..aa76311d81 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -53,13 +53,13 @@ tags: context: - source:endpoint - stage: Impact - message: A samsam ransomware test file creation in $Filesystem.file_path$ in host $Filesystem.dest$ + message: A samsam ransomware test file creation in $file_path$ in host $dest$ observable: - - name: Filesystem.dest + - name: dest type: Hostname role: - Victim - - name: Filesystem.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 4629395cdd..c6c5fa19b2 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -67,13 +67,13 @@ tags: - source:endpoint - stage: Persistence - Privilege Escalation - message: A sc process $Processes.process_name$ with commandline $Processes.process$ to create of configure services in host $Processes.dest$ + message: A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 92349c9e8f..2d9379c71e 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -60,13 +60,13 @@ tags: - stage: Execution - Persistence - Privilege Escalation - message: A schedule task process $Processes.process_name$ with create or delete commandline $Processes.process$ in host $Processes.dest$ + message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index dffb5426c6..d9069d95a0 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -56,13 +56,13 @@ tags: - stage: Execution - Persistence - Privilege Escalation - message: A "on demand" execution of schedule task process $Processes.process_name$ using commandline $Processes.process$ in host $Processes.dest$ + message: A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 5cd8e99bb5..d5a9bfbd24 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -60,7 +60,7 @@ tags: - stage: Execution - Persistence - Privilege Escalation - message: A schedule task process $Processes.process_name$ with remote job commandline $Processes.process$ in host $Processes.dest$ + message: A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ observable: - name: Processes.dest type: Hostname diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 5f6a85431c..41791eedee 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -57,13 +57,13 @@ tags: - stage: Execution - Persistence - Privilege Escalation - message: A schedule task process $Processes.process_name$ with force reboot commandline $Processes.process$ in host $Processes.dest$ + message: A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index 5316b016c1..93157bf846 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -56,13 +56,13 @@ tags: context: - source:endpoint - stage: Execution - message: A wmic.exe process $Processes.process_name$ taht execute script in host $Processes.dest$ + message: A wmic.exe process $process_name$ taht execute script in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index cba710ce5c..d7fcfe398f 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -59,9 +59,9 @@ tags: - source:endpoint - stage: Defense Evasion - Privilege Escalation - message: A searchprotocolhost.exe process $Processes.process_name$ with no commandline in host $Processes.dest$ + message: A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index aae26ebd2d..c455c3613b 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -57,13 +57,13 @@ tags: context: - source:endpoint - stage: Credential Access - message: A secretdump process $Processes.process_name$ with secretdump commandline $Processes.process$ to dump credentials in host $Processes.dest$ + message: A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index 2a9b262aa9..fe166aca87 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -65,7 +65,7 @@ tags: - source:endpoint - stage: Privilege Escalation - Defense Evasion - message: A service process $Processes.parent_process_name$ with process path $Processes.process_path$ in host $Processes.dest$ + message: A service process $parent_process_name$ with process path $process_path$ in host $dest$ observable: - name: Processes.dest type: Hostname diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index bceea27ca2..886bcdb0b3 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -60,13 +60,13 @@ tags: context: - source:endpoint - stage: Execution - message: A registry modification in $Registry.registry_path$ with reg key $Registry.registry_key_name$ and reg value $Registry.registry_value_name$ in host $Registry.dest$ + message: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ observable: - - name: Registry.dest + - name: dest type: Hostname role: - Victim - - name: Registry.registry_path + - name: registry_path type: RegistryPath role: - Others diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index ad1a9c0022..912e0e950b 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -57,13 +57,13 @@ tags: - source:endpoint - stage: Privilege Escalation - Persistence - message: A process that possibly write shim database in $Filesystem.file_path$ in host $Filesystem.dest$ + message: A process that possibly write shim database in $file_path$ in host $dest$ observable: - - name: Filesystem.dest + - name: dest type: Hostname role: - Victim - - name: Filesystem.file_path + - name: file_path type: file path role: - Others diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 9ec6c0e088..d5027553cc 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -57,13 +57,13 @@ tags: - source:endpoint - stage: Privilege Escalation - Persistence - message: A process $Processes.process_name$ that possible create a shim db silently in host $Processes.dest$ + message: A process $process_name$ that possible create a shim db silently in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 0fe93eec3b..4a0bad0cf3 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -53,13 +53,13 @@ tags: context: - source:endpoint - stage: Persistence - message: A user account created or delete shortly in host $All_Changes.dest$ + message: A user account created or delete shortly in host $dest$ observable: - - name: All_Changes.dest + - name: dest type: Hostname role: - Victim - - name: All_Changes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index a11048a1aa..0f0a908523 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -56,13 +56,13 @@ tags: context: - source:endpoint - stage: Execution - message: A suspicious process $Processes.process_name$ with single letter in host $Processes.dest$ + message: A suspicious process $process_name$ with single letter in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index b6c98d91bd..e239ff1d13 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -61,13 +61,13 @@ tags: context: - source:endpoint - stage: Privilege Escalation - message: A slui process $Processes.process_name$ with elevated commandline $Processes.process$ in host $Processes.dest$ + message: A slui process $process_name$ with elevated commandline $process$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: Hostname role: - Victim \ No newline at end of file diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index bc0c9106d6..5c15257a3d 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -59,13 +59,13 @@ tags: context: - source:endpoint - stage: Privilege Escalation - message: A slui process $Processes.parent_process_name$ spawning child process $Processes.process_name$ in host $Processes.dest$ + message: A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ observable: - - name: Processes.dest + - name: dest type: Hostname role: - Victim - - name: Processes.user + - name: user type: user role: - Victim diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index a8693902c7..2eb0a6eb5c 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -87,13 +87,13 @@ tags: context: - source:endpoint - stage: Initial Access - message: A dns query $DNS.query$ from your infra connecting to suspicious domain in host $host$ + message: A dns query $query$ from your infra connecting to suspicious domain in host $host$ observable: - name: host type: Hostname role: - Victim - - name: DNS.query + - name: query type: dnsquery role: - Attacker diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 3f5c7a42d6..49afe7914a 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -53,13 +53,13 @@ tags: context: - Source:Endpoint - Stage:Exfiltration - message: A dns query $DNS.query$ with 2 time standard deviation of name len of the dns query in host $host$ + message: A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ observable: - name: host type: Hostname role: - Victim - - name: DNS.query + - name: query type: dnsquery role: - Attacker \ No newline at end of file