diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index 0d5c05dcf5..b5fd623ec8 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -55,7 +55,6 @@ tags: - user - action - message - risk_score: 64 security_domain: network cve: - CVE-2024-4040 diff --git a/detections/application/detect_distributed_password_spray_attempts.yml b/detections/application/detect_distributed_password_spray_attempts.yml index 57e3a99e1d..a1f79e1866 100644 --- a/detections/application/detect_distributed_password_spray_attempts.yml +++ b/detections/application/detect_distributed_password_spray_attempts.yml @@ -71,7 +71,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - Authentication.user - Authentication.src diff --git a/detections/application/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml index 1177fe653b..ce0f276757 100644 --- a/detections/application/detect_new_login_attempts_to_routers.yml +++ b/detections/application/detect_new_login_attempts_to_routers.yml @@ -36,5 +36,4 @@ tags: - Authentication.dest_category - Authentication.dest - Authentication.user - risk_score: 25 security_domain: network diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml index 7f70cd0f7b..b923f20f15 100644 --- a/detections/application/detect_password_spray_attempts.yml +++ b/detections/application/detect_password_spray_attempts.yml @@ -81,7 +81,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 70 required_fields: - Authentication.action - Authentication.user diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index a25822aab7..2a478349b4 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -41,5 +41,4 @@ tags: - All_Email.src_user - All_Email.file_name - All_Email.message_id - risk_score: 25 security_domain: network diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index b30ba515aa..a598f0b09e 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -38,5 +38,4 @@ tags: - Filesystem.action - Filesystem.process_id - Filesystem.dest - risk_score: 25 security_domain: endpoint diff --git a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml index d978a5a014..66fa59958e 100644 --- a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -36,5 +36,4 @@ tags: - All_Traffic.bytes_out - All_Traffic.src_category - All_Traffic.dest_ip - risk_score: 25 security_domain: network diff --git a/detections/application/ivanti_vtm_new_account_creation.yml b/detections/application/ivanti_vtm_new_account_creation.yml index 800c5cd88c..fa5ff0d906 100644 --- a/detections/application/ivanti_vtm_new_account_creation.yml +++ b/detections/application/ivanti_vtm_new_account_creation.yml @@ -48,7 +48,6 @@ tags: - OPERATION - MODGROUP - AUTH - risk_score: 72 security_domain: access cve: - CVE-2024-7593 diff --git a/detections/application/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml index 3ecae133f8..14cbb4c2ff 100644 --- a/detections/application/monitor_email_for_brand_abuse.yml +++ b/detections/application/monitor_email_for_brand_abuse.yml @@ -33,5 +33,4 @@ tags: - All_Email.recipient - All_Email.src_user - All_Email.message_id - risk_score: 25 security_domain: network diff --git a/detections/application/no_windows_updates_in_a_time_frame.yml b/detections/application/no_windows_updates_in_a_time_frame.yml index 3e5cbbfab8..c69bf19291 100644 --- a/detections/application/no_windows_updates_in_a_time_frame.yml +++ b/detections/application/no_windows_updates_in_a_time_frame.yml @@ -32,5 +32,4 @@ tags: - Updates.status - Updates.vendor_product - Updates.dest - risk_score: 25 security_domain: endpoint diff --git a/detections/application/okta_authentication_failed_during_mfa_challenge.yml b/detections/application/okta_authentication_failed_during_mfa_challenge.yml index 22fa5d249f..ea00f8ed4f 100644 --- a/detections/application/okta_authentication_failed_during_mfa_challenge.yml +++ b/detections/application/okta_authentication_failed_during_mfa_challenge.yml @@ -59,7 +59,6 @@ tags: - Authentication.signature - Authentication.method - Authentication.src - risk_score: 48 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_idp_lifecycle_modifications.yml b/detections/application/okta_idp_lifecycle_modifications.yml index a8530426c8..28f64b9f22 100644 --- a/detections/application/okta_idp_lifecycle_modifications.yml +++ b/detections/application/okta_idp_lifecycle_modifications.yml @@ -56,7 +56,6 @@ tags: - user_agent - command - description - risk_score: 81 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_mfa_exhaustion_hunt.yml b/detections/application/okta_mfa_exhaustion_hunt.yml index 6ee99861d9..618f9e90c1 100644 --- a/detections/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/application/okta_mfa_exhaustion_hunt.yml @@ -40,7 +40,6 @@ tags: - src_ip - eventType - status - risk_score: 18 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index 7833aa0843..b5bbc16855 100644 --- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -45,5 +45,4 @@ tags: - client.userAgent.rawUserAgent - debugContext.debugData.behaviors - group_push_time - risk_score: 64 security_domain: access diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml index 328f02f3e7..71d4326260 100644 --- a/detections/application/okta_multi_factor_authentication_disabled.yml +++ b/detections/application/okta_multi_factor_authentication_disabled.yml @@ -55,7 +55,6 @@ tags: - All_Changes.result - All_Changes.src - sourcetype - risk_score: 30 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_multiple_accounts_locked_out.yml b/detections/application/okta_multiple_accounts_locked_out.yml index c52dab5f39..f368fb1aca 100644 --- a/detections/application/okta_multiple_accounts_locked_out.yml +++ b/detections/application/okta_multiple_accounts_locked_out.yml @@ -54,7 +54,6 @@ tags: - All_Changes.result - All_Changes.src - sourcetype - risk_score: 49 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml index 2c8978c81a..79c76bf941 100644 --- a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml @@ -52,7 +52,6 @@ tags: - displayMessage - src_user - src_ip - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/application/okta_multiple_failed_requests_to_access_applications.yml index 55e920f461..120a986500 100644 --- a/detections/application/okta_multiple_failed_requests_to_access_applications.yml +++ b/detections/application/okta_multiple_failed_requests_to_access_applications.yml @@ -40,5 +40,4 @@ tags: - actor.alternateId - client.ipAddress - eventType - risk_score: 56 security_domain: access diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml index ef0695c6d9..9f39281cb5 100644 --- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml @@ -54,7 +54,6 @@ tags: - Authentication.authentication_method - Authentication.action - Authentication.src - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index efc52c59fb..e0e01fd181 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -55,7 +55,6 @@ tags: - outcome.reason - outcome.result - severity - risk_score: 64 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index f22e0a0020..2110d17da3 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -51,7 +51,6 @@ tags: - client.userAgent.browser - client.geographicalContext.city - client.geographicalContext.country - risk_score: 24 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml index 65f1958031..caf537fe72 100644 --- a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml +++ b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml @@ -40,5 +40,4 @@ tags: - client.userAgent.browser - outcome.reason - displayMessage - risk_score: 100 security_domain: access diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index c360e4a827..35cbdf6760 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -53,7 +53,6 @@ tags: - All_Risk.annotations.mitre_attack.mitre_technique_id - All_Risk.tag - _time - risk_score: 56 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/okta_successful_single_factor_authentication.yml b/detections/application/okta_successful_single_factor_authentication.yml index fa763224c2..bb068a87ae 100644 --- a/detections/application/okta_successful_single_factor_authentication.yml +++ b/detections/application/okta_successful_single_factor_authentication.yml @@ -56,7 +56,6 @@ tags: - src_ip - user - _time - risk_score: 48 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml index 29ac37c307..4153d4c718 100644 --- a/detections/application/okta_suspicious_activity_reported.yml +++ b/detections/application/okta_suspicious_activity_reported.yml @@ -50,7 +50,6 @@ tags: - client.userAgent.browser - client.geographicalContext.city - client.geographicalContext.country - risk_score: 25 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/application/okta_suspicious_use_of_a_session_cookie.yml index ec8d918f49..17b39f8a09 100644 --- a/detections/application/okta_suspicious_use_of_a_session_cookie.yml +++ b/detections/application/okta_suspicious_use_of_a_session_cookie.yml @@ -51,7 +51,6 @@ tags: - device.os_platform - debugContext.debugData.dtHash - actor.alternateId - risk_score: 56 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml index ff8e450573..0ca328d3c8 100644 --- a/detections/application/okta_threatinsight_threat_detected.yml +++ b/detections/application/okta_threatinsight_threat_detected.yml @@ -58,7 +58,6 @@ tags: - outcome.reason - outcome.result - severity - risk_score: 25 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/okta_unauthorized_access_to_application.yml b/detections/application/okta_unauthorized_access_to_application.yml index b0c9aa46ea..dc505246b4 100644 --- a/detections/application/okta_unauthorized_access_to_application.yml +++ b/detections/application/okta_unauthorized_access_to_application.yml @@ -54,7 +54,6 @@ tags: - Authentication.signature - Authentication.method - Authentication.src - risk_score: 81 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index 49a48a1e63..4d7257a7f7 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -54,7 +54,6 @@ tags: - Authentication.signature - Authentication.method - Authentication.src - risk_score: 81 security_domain: identity tests: - name: True Positive Test diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml index 6efe1f2075..672fd8c833 100644 --- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml +++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml @@ -61,7 +61,6 @@ tags: - resources{}.devicemodel - result.status - resources{}.websession - risk_score: 25 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml index d00607d0bf..0a47e81a7c 100644 --- a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml @@ -53,7 +53,6 @@ tags: - result.message - resources{}.devicemodel - result.status - risk_score: 50 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 1acd9b572e..d717840f25 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -60,7 +60,6 @@ tags: - actors{}.name - result.message - resources{}.devicemodel - risk_score: 50 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/pingid_new_mfa_method_registered_for_user.yml b/detections/application/pingid_new_mfa_method_registered_for_user.yml index addf5d57bd..af83e2668a 100644 --- a/detections/application/pingid_new_mfa_method_registered_for_user.yml +++ b/detections/application/pingid_new_mfa_method_registered_for_user.yml @@ -60,7 +60,6 @@ tags: - result.message - resources{}.devicemodel - result.status - risk_score: 10 security_domain: access tests: - name: True Positive Test diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index fd986ae658..827b9b97a0 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -42,5 +42,4 @@ tags: - All_Email.file_name - All_Email.src_user - All_Email.message_id - risk_score: 25 security_domain: network diff --git a/detections/application/suspicious_java_classes.yml b/detections/application/suspicious_java_classes.yml index b918ceb4d0..5ae748f1e7 100644 --- a/detections/application/suspicious_java_classes.yml +++ b/detections/application/suspicious_java_classes.yml @@ -41,5 +41,4 @@ tags: - http_user_agent - src - dest - risk_score: 25 security_domain: threat diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index 8c79f797d2..710c6419a7 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -41,5 +41,4 @@ tags: - Processes.process_name - Processes.dest - Processes.user - risk_score: 25 security_domain: endpoint diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/application/windows_ad_add_self_to_group.yml index f07ffac090..0c4ec5c71d 100644 --- a/detections/application/windows_ad_add_self_to_group.yml +++ b/detections/application/windows_ad_add_self_to_group.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - EventCode - user diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml index 0ba903b988..bed335d752 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml index 9f496117de..98b8c7976b 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml index d420f37861..e6b58f0709 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index 0af44c4fc4..f61462eb6d 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml index 83750b99b1..e4e6459a69 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml index 7e1026fc34..2edfa9b0a0 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml index 71e1516dd5..f3ff910408 100644 --- a/detections/application/windows_ad_gpo_deleted.yml +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml index e33028676f..4e8b0e74fb 100644 --- a/detections/application/windows_ad_gpo_disabled.yml +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index 656115a834..ee14e47902 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml index 31dd669905..fdbe51cf0d 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml index 76ccb9cf3c..c206f1606a 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml index 3256d9d220..838be6e3d5 100644 --- a/detections/application/windows_ad_privileged_group_modification.yml +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -32,7 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - EventCode - user diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml index 04987480df..fb9a674634 100644 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 80 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index a55f2540fc..f8bc11e235 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - OperationType diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index d959ca51fb..91cf07598d 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 80 required_fields: - _time - OperationType diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml index f2a1a593ec..562fc1eeea 100644 --- a/detections/application/windows_increase_in_group_or_object_modification_activity.yml +++ b/detections/application/windows_increase_in_group_or_object_modification_activity.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - EventCode - src_user diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml index 11c461d17f..932d3491cd 100644 --- a/detections/application/windows_increase_in_user_modification_activity.yml +++ b/detections/application/windows_increase_in_user_modification_activity.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - EventCode - src_user diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 5c8ebae8a8..6743fffc65 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -37,7 +37,6 @@ tags: - All_Changes.command - All_Changes.user - All_Changes.status - risk_score: 15 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml index f08c410c3f..eec3281c3d 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml @@ -42,5 +42,4 @@ tags: - All_Changes.status - All_Changes.object_category - All_Changes.user - risk_score: 25 security_domain: threat diff --git a/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml b/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml index 93a18c80b5..917123c3f8 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml @@ -39,5 +39,4 @@ tags: - All_Changes.status - All_Changes.object_category - All_Changes.user - risk_score: 25 security_domain: threat diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index ac1b861904..433fd5f328 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -37,7 +37,6 @@ tags: - All_Changes.object_category - All_Changes.status - All_Changes.user - risk_score: 15 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml index 16e8024f5b..2fc8636413 100644 --- a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml @@ -41,5 +41,4 @@ tags: - requestURI - src_ip - user.groups{} - risk_score: 25 security_domain: threat diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index 3795333aaf..652cc09432 100644 --- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -42,5 +42,4 @@ tags: - userAgent - src_ip - user.groups{} - risk_score: 25 security_domain: threat diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index b73048a0b5..b4d230408c 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -55,7 +55,6 @@ tags: - src_endpoint.ip - src_endpoint.domain - cloud.region - risk_score: 42 security_domain: threat manual_test: Can't be tested automatically because of time span. tests: diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml index 51ebc415fb..c55e2b38e0 100644 --- a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml index 0f8e4198ed..f5bf4fa52e 100644 --- a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml index 9188eab76a..cb20aa104a 100644 --- a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml @@ -45,7 +45,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml index 06d6855331..df4e6f27fd 100644 --- a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml index 5e700e7519..9f9ffab9a2 100644 --- a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml index 664e40bfbb..6dd232e0d6 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml @@ -48,7 +48,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index b3506df343..a1359b3999 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_iam_delete_policy.yml b/detections/cloud/asl_aws_iam_delete_policy.yml index f130dda68e..c8562ed159 100644 --- a/detections/cloud/asl_aws_iam_delete_policy.yml +++ b/detections/cloud/asl_aws_iam_delete_policy.yml @@ -43,7 +43,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 10 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_iam_failure_group_deletion.yml b/detections/cloud/asl_aws_iam_failure_group_deletion.yml index 1476e1877d..d8ea3a5757 100644 --- a/detections/cloud/asl_aws_iam_failure_group_deletion.yml +++ b/detections/cloud/asl_aws_iam_failure_group_deletion.yml @@ -52,7 +52,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 5 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_iam_successful_group_deletion.yml b/detections/cloud/asl_aws_iam_successful_group_deletion.yml index 99c5289b53..3efca74f61 100644 --- a/detections/cloud/asl_aws_iam_successful_group_deletion.yml +++ b/detections/cloud/asl_aws_iam_successful_group_deletion.yml @@ -45,7 +45,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 5 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml index df252c921e..3402599b11 100644 --- a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml @@ -56,7 +56,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml index 989b32fff1..538c54f2fe 100644 --- a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml @@ -46,7 +46,6 @@ tags: - http_request.user_agent - src_endpoint.ip - cloud.region - risk_score: 64 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml index 8ed30c0d5b..89fe1dcc9e 100644 --- a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml +++ b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml @@ -61,7 +61,6 @@ tags: - vendor_region - user_agent - userIdentity.principalId - risk_score: 80 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index bfe25effd2..c7b841c752 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -55,7 +55,6 @@ tags: - user_arn - aws_account_id - src_ip - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index 753a51ea7a..f597c03570 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -60,7 +60,6 @@ tags: - awsRegion - user_name - userIdentity.arn - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 567992adfa..f69ab78290 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -53,7 +53,6 @@ tags: - aws_account_id - awsRegion - eventID - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 80e4d0492a..67bef1b4f0 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -43,7 +43,6 @@ tags: - userAgent - errorCode - requestParameters.userName - risk_score: 63 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index df61daf43b..28df15ddca 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -52,7 +52,6 @@ tags: - userAgent - errorCode - requestParameters.userName - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index 725eaabcc0..84eee07cf5 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -56,7 +56,6 @@ tags: - dest - user - user_id - risk_score: 49 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index e44bd0923d..e228029a05 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -57,7 +57,6 @@ tags: - userIdentity.accountId - sourceIPAddress - awsRegion - risk_score: 49 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 12fec148b6..3f4c8ce2b4 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -54,7 +54,6 @@ tags: - userAgent - sourceIPAddress - awsRegion - risk_score: 49 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index b4ab080433..10c40dee39 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -39,7 +39,6 @@ tags: - Authentication.user - Authentication.user_role - Authentication.src - risk_score: 15 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml index 6f641c7a60..72fe47c526 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml @@ -54,7 +54,6 @@ tags: - aws_account_id - src - region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index b3592458d3..1570e5e9f5 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -54,7 +54,6 @@ tags: - aws_account_id - src - region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml index 3f56568fb1..25f0dfe19b 100644 --- a/detections/cloud/aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -55,7 +55,6 @@ tags: - src - region - errorCode - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml index eaaf7d469a..d91723b92a 100644 --- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml +++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml @@ -49,7 +49,6 @@ tags: - region - requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days - requestParameters{}.bucketName - risk_score: 20 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index 295ffc430a..bbc6c713a8 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -54,7 +54,6 @@ tags: - aws_account_id - src - region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index df108b6ae9..b8996c219b 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -54,7 +54,6 @@ tags: - aws_account_id - src - region - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_detect_attach_to_role_policy.yml b/detections/cloud/aws_detect_attach_to_role_policy.yml index ac2ad5e64a..52223fcad7 100644 --- a/detections/cloud/aws_detect_attach_to_role_policy.yml +++ b/detections/cloud/aws_detect_attach_to_role_policy.yml @@ -32,5 +32,4 @@ tags: required_fields: - _time - requestParameters.policyArn - risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_permanent_key_creation.yml b/detections/cloud/aws_detect_permanent_key_creation.yml index feb8296518..9554b96ae7 100644 --- a/detections/cloud/aws_detect_permanent_key_creation.yml +++ b/detections/cloud/aws_detect_permanent_key_creation.yml @@ -41,5 +41,4 @@ tags: - responseElements.accessKey.createDate - esponseElements.accessKey.status - responseElements.accessKey.accessKeyId - risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_role_creation.yml b/detections/cloud/aws_detect_role_creation.yml index 6b9fa9aba6..7f9c91cb39 100644 --- a/detections/cloud/aws_detect_role_creation.yml +++ b/detections/cloud/aws_detect_role_creation.yml @@ -48,5 +48,4 @@ tags: - requestParameters.description - responseElements.role.arn - responseElements.role.createDate - risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/cloud/aws_detect_sts_assume_role_abuse.yml index cfac2757f8..2ee22c5038 100644 --- a/detections/cloud/aws_detect_sts_assume_role_abuse.yml +++ b/detections/cloud/aws_detect_sts_assume_role_abuse.yml @@ -42,5 +42,4 @@ tags: - requestParameters.roleName - esponseElements.role.roleName - esponseElements.role.createDate - risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_sts_get_session_token_abuse.yml b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml index 786a155632..ef0a4b74ee 100644 --- a/detections/cloud/aws_detect_sts_get_session_token_abuse.yml +++ b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml @@ -41,5 +41,4 @@ tags: - user_type - status - region - risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index bd135750bd..2241dbcca3 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -51,7 +51,6 @@ tags: - awsRegion - requestParameters.policy - userIdentity.principalId - risk_score: 25 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 0e8a27b026..8a259e01fa 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -51,7 +51,6 @@ tags: - requestParameters.key - userAgent - region - risk_score: 15 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml index 6fa9db70cd..6df27f6bf5 100644 --- a/detections/cloud/aws_disable_bucket_versioning.yml +++ b/detections/cloud/aws_disable_bucket_versioning.yml @@ -60,7 +60,6 @@ tags: - sourceLocationArn - userAgent - userIdentity.principalId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml index ef27377ae0..f79b628265 100644 --- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml +++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml @@ -61,7 +61,6 @@ tags: - vendor_region - user_agent - userIdentity.principalId - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index d2a76017a5..f420708bbe 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -55,7 +55,6 @@ tags: - user - userName - src_ip - risk_score: 70 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index 245e8ca743..4e56826322 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -55,7 +55,6 @@ tags: - user - userName - src_ip - risk_score: 5 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index ee7ebcdc9a..eeca279e83 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -55,7 +55,6 @@ tags: - user - userName - src_ip - risk_score: 21 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 4b6163a01a..c40ba491ef 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -55,7 +55,6 @@ tags: - user - userName - src_ip - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 291255f240..993f73b6cf 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -55,7 +55,6 @@ tags: - user - userName - src_ip - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 0ef9f0ba6e..f8c5b1dc2c 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -51,7 +51,6 @@ tags: - userAgent - user - userIdentity.arn - risk_score: 18 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml index 164fa36716..f723aa7fb8 100644 --- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml +++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml @@ -58,7 +58,6 @@ tags: - aws_account_id - userAgent - userIdentity.principalId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index b781649f91..f7b5478487 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -52,7 +52,6 @@ tags: - src_ip - aws_account_id - userAgent - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml index 71340c194c..8ef2909222 100644 --- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml +++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml @@ -60,7 +60,6 @@ tags: - vendor_region - user_agent - userIdentity.principalId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml index 94e59c0583..6e8bbbadc3 100644 --- a/detections/cloud/aws_exfiltration_via_datasync_task.yml +++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml @@ -60,7 +60,6 @@ tags: - sourceLocationArn - userAgent - userIdentity.principalId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index 3a8df695ce..6d429a61a5 100644 --- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -66,7 +66,6 @@ tags: - user_agent - userIdentity.principalId - requestParameters.createVolumePermission.add.items{}.userId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index 255ec8a16b..0063e1978c 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -51,7 +51,6 @@ tags: - user_arn - aws_account_id - src_ip - risk_score: 35 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 660947adec..efe8491586 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -51,7 +51,6 @@ tags: - action - eventName - src_ip - risk_score: 54 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index c68b8b492b..365f3da86b 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -51,7 +51,6 @@ tags: - userAgent - errorCode - userIdentity.type - risk_score: 10 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 642ae1547a..a2feca0c16 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -53,7 +53,6 @@ tags: - userAgent - errorCode - requestParameters.policyName - risk_score: 28 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index cf68ebc5f7..7acd42855a 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -42,7 +42,6 @@ tags: - userAgent - errorCode - requestParameters.policyArn - risk_score: 10 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 5a154ffabb..732ba87466 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -51,7 +51,6 @@ tags: - userAgent - errorCode - requestParameters.groupName - risk_score: 5 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 1a0a4cdd0b..7cfdbaf6eb 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -48,7 +48,6 @@ tags: - userAgent - errorCode - requestParameters.groupName - risk_score: 5 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml index 7a6423711f..10eabc84f4 100644 --- a/detections/cloud/aws_lambda_updatefunctioncode.yml +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -41,7 +41,6 @@ tags: - eventName - userAgent - errorCode - risk_score: 63 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml index 7ac1b5a8b4..380276b02a 100644 --- a/detections/cloud/aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml @@ -66,7 +66,6 @@ tags: - awsRegion - user_name - userIdentity.arn - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index c40308c3db..cdb7624067 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -59,7 +59,6 @@ tags: - awsRegion - user_name - userIdentity.arn - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index fe54a04cb1..ae1789f08c 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -61,7 +61,6 @@ tags: - action - eventName - src_ip - risk_score: 54 security_domain: threat manual_test: This search needs a specific number of events in a time window for the alert to trigger and events split up in CI testing while updating timestamp. tests: diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index 451dcbaaa5..359c6ab165 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -57,7 +57,6 @@ tags: - userName - userIdentity.principalId - userAgent - risk_score: 48 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 5202562353..9eb9d895bc 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -52,7 +52,6 @@ tags: - userIdentity.principalId - src - userAgent - risk_score: 5 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 644a6ca2de..c5c34bfdb6 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -60,7 +60,6 @@ tags: - user_name - userIdentity.arn - _time - risk_score: 64 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index b09c1efbf5..be67512b4f 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -48,7 +48,6 @@ tags: - user_arn - aws_account_id - src_ip - risk_score: 72 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml index e7f799bd4e..9861675f80 100644 --- a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml +++ b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml @@ -49,7 +49,6 @@ tags: - All_Risk.annotations.mitre_attack.mitre_tactic - All_Risk.calculated_risk_score - source - risk_score: 81 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index cdc1df64c1..00be7d2042 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -57,7 +57,6 @@ tags: - responseElements.issuer - sourceIPAddress - userAgent - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 08f761d472..4772cc3840 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -56,7 +56,6 @@ tags: - sourceIPAddress - userIdentity.accessKeyId - userIdentity.principalId - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index ce14202849..baad30743b 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -53,7 +53,6 @@ tags: - errorCode - requestParameters.userName - eventSource - risk_score: 30 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml index 13c9247aa6..37d4b184b6 100644 --- a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml +++ b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml @@ -52,7 +52,6 @@ tags: - userAgent - src_ip - user_arn - risk_score: 72 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml index 4fb97224a7..afb2c1cfdf 100644 --- a/detections/cloud/aws_successful_single_factor_authentication.yml +++ b/detections/cloud/aws_successful_single_factor_authentication.yml @@ -61,7 +61,6 @@ tags: - awsRegion - user_name - userIdentity.arn - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index bd7f9794e1..aa631cd92d 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -56,7 +56,6 @@ tags: - action - eventName - src_ip - risk_score: 54 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 5b7afc1a65..1ab6111f86 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -52,7 +52,6 @@ tags: - userAgent - errorCode - requestParameters.userName - risk_score: 30 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index c12e138e56..1df5595147 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -59,7 +59,6 @@ tags: - properties.activity - properties.riskEventType - properties.additionalInfo - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml index bcf5ca35c1..9c932c8376 100644 --- a/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml +++ b/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml @@ -50,7 +50,6 @@ tags: - operationName - targetResources{}.modifiedProperties{}.newValue - targetResources{}.id - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml index 5b148f2137..24132eff06 100644 --- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml @@ -56,7 +56,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 5932c5e285..28f1f0a3a9 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -62,7 +62,6 @@ tags: - properties.status.additionalDetails - properties.appDisplayName - properties.userAgent - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml index e7fed2c8eb..305fde0ca2 100644 --- a/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml +++ b/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 2753e73925..f0fc21f7ce 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -54,7 +54,6 @@ tags: - properties.authenticationDetails - user - src_ip - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_device_code_authentication.yml b/detections/cloud/azure_ad_device_code_authentication.yml index 87ea1fab30..067d131ab2 100644 --- a/detections/cloud/azure_ad_device_code_authentication.yml +++ b/detections/cloud/azure_ad_device_code_authentication.yml @@ -50,7 +50,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 35 required_fields: - _time - category diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 7efe7bace2..c9b2ed2709 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -53,7 +53,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 45 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml b/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml index 4d11032bed..6806e0edb9 100644 --- a/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml +++ b/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml @@ -46,7 +46,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index 34e0d25a4a..91b0c7007e 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -56,7 +56,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 72 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index d228df26b5..57600d83db 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -50,7 +50,6 @@ tags: - properties.authenticationDetails - user - properties.ipAddress - risk_score: 35 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 81a682ea42..20ccbe4824 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -57,7 +57,6 @@ tags: - properties.authenticationDetails - user - src_ip - risk_score: 35 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index b731fd24d7..0f8556271c 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -56,7 +56,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 45 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml b/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml index 762edbf371..8559310a9e 100644 --- a/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml +++ b/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 42 required_fields: - _time - category diff --git a/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml index 5afdf5ba30..3031d4d1e2 100644 --- a/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml +++ b/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 48 required_fields: - _time - category diff --git a/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml index fdabbd592b..215e8e41e7 100644 --- a/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 54 required_fields: - _time - category diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index cedeef1f6f..766195505b 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -57,7 +57,6 @@ tags: - user - user_agent - operationName - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml b/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml index 1b5a88d8d8..dccd99a8f5 100644 --- a/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml +++ b/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml @@ -44,7 +44,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml b/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml index 0e32c6949f..b9ec4273b0 100644 --- a/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml +++ b/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml @@ -48,7 +48,6 @@ tags: - properties.initiatedBy.user.id - targetResources{}.displayName - src_user - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 140fa49f80..0aca20f1ec 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -58,7 +58,6 @@ tags: - properties.authenticationDetails - user - user_agent - risk_score: 63 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml index a882652264..638e0ee560 100644 --- a/detections/cloud/azure_ad_new_custom_domain_added.yml +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -53,7 +53,6 @@ tags: - src_ip - properties.targetResources{}.displayName - user - risk_score: 54 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index 4ed7fcabff..91fdbee823 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -52,7 +52,6 @@ tags: - src_ip - properties.targetResources{}.displayName - user - risk_score: 81 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_new_mfa_method_registered.yml b/detections/cloud/azure_ad_new_mfa_method_registered.yml index 01c60a3fa0..04a8261acb 100644 --- a/detections/cloud/azure_ad_new_mfa_method_registered.yml +++ b/detections/cloud/azure_ad_new_mfa_method_registered.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml index 787f7c5816..85ee38d55a 100644 --- a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml @@ -58,7 +58,6 @@ tags: - resultDescription - result - src_ip - risk_score: 64 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml index 9b370e317d..00538c3801 100644 --- a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml +++ b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_pim_role_assigned.yml b/detections/cloud/azure_ad_pim_role_assigned.yml index 3c10452668..ede5c75f3a 100644 --- a/detections/cloud/azure_ad_pim_role_assigned.yml +++ b/detections/cloud/azure_ad_pim_role_assigned.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 35 required_fields: - _time - properties diff --git a/detections/cloud/azure_ad_pim_role_assignment_activated.yml b/detections/cloud/azure_ad_pim_role_assignment_activated.yml index b3ef1f5dc4..93c4cd6e21 100644 --- a/detections/cloud/azure_ad_pim_role_assignment_activated.yml +++ b/detections/cloud/azure_ad_pim_role_assignment_activated.yml @@ -51,7 +51,6 @@ tags: - user - initiatedBy.user.userPrincipalName - result - risk_score: 35 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml index 84ff7183e3..3cf395f7fc 100644 --- a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml @@ -52,7 +52,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 50 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml b/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml index e7ca09a520..1ba88a27d5 100644 --- a/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml +++ b/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 54 required_fields: - _time - category diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index 8f3e9b1cd3..333ea3be22 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -57,7 +57,6 @@ tags: - properties.targetResources{}.type - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 63 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 1a4892d35f..872f57c9de 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 35 required_fields: - _time - properties.targetResources{}.type diff --git a/detections/cloud/azure_ad_service_principal_authentication.yml b/detections/cloud/azure_ad_service_principal_authentication.yml index 525fd071cb..9d6d108e9b 100644 --- a/detections/cloud/azure_ad_service_principal_authentication.yml +++ b/detections/cloud/azure_ad_service_principal_authentication.yml @@ -55,7 +55,6 @@ tags: - user - src_ip - user_id - risk_score: 25 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 00c27e728c..17d630a823 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -51,7 +51,6 @@ tags: - properties.targetResources{}.type - user - properties.result - risk_score: 45 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index dbcc94eb53..42b64e2c6f 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -56,7 +56,6 @@ tags: - properties.targetResources{}.displayName - properties.targetResources{}.modifiedProperties{}.newValue - src_ip - risk_score: 35 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index ebe9073415..ced677d499 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -53,7 +53,6 @@ tags: - properties.targetResources{}.userPrincipalName - properties.targetResources{}.modifiedProperties{}.newValue - properties.result - risk_score: 54 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 68c04f310c..56be1c21ca 100644 --- a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -57,7 +57,6 @@ tags: - user - src_ip - properties.appDisplayName - risk_score: 56 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 08479340be..d315ab4788 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -58,7 +58,6 @@ tags: - src_ip - properties.appDisplayName - properties.userAgent - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 1c582dd9e2..bffecaaa72 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -57,7 +57,6 @@ tags: - user - src_ip - properties.appDisplayName - risk_score: 45 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml b/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml index b1fb8df1a2..5cfaaffe72 100644 --- a/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml +++ b/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index bbcfbd47b4..e4d0aa7f7a 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -58,7 +58,6 @@ tags: - properties.authenticationDetails - properties.userPrincipalName - properties.ipAddress - risk_score: 54 security_domain: access tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 126bfeabc6..6927ad243d 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml b/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml index 2588633b87..7bba96ae74 100644 --- a/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - operationName diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 96eebea8e4..8f5b2056b4 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -52,7 +52,6 @@ tags: - user - properties.initiatedBy.user.userPrincipalName - properties.result - risk_score: 45 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index e1ed90fbe5..df26eba9bc 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -51,7 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 45 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml index 067f10815d..f0edef4040 100644 --- a/detections/cloud/azure_automation_account_created.yml +++ b/detections/cloud/azure_automation_account_created.yml @@ -56,7 +56,6 @@ tags: - claims.ipaddr - resourceGroupName - object_path - risk_score: 63 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 9439a062c0..483479f657 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -56,7 +56,6 @@ tags: - claims.ipaddr - resourceGroupName - object_path - risk_score: 63 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml index bbc6b93cb8..e332c06356 100644 --- a/detections/cloud/azure_runbook_webhook_created.yml +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -56,7 +56,6 @@ tags: - claims.ipaddr - resourceGroupName - object_path - risk_score: 63 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 391ff4983d..56bdcd3790 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -41,7 +41,6 @@ tags: - Splunk Cloud required_fields: - _times - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index aeb0ac9fd1..83e12fdfab 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -32,7 +32,6 @@ tags: - Splunk Cloud required_fields: - _times - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index b7e7408bbe..667ab3ac49 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -37,7 +37,6 @@ tags: - All_Changes.status - All_Changes.command - All_Changes.object - risk_score: 36 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 47503c9cdd..85ff38be36 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -41,7 +41,6 @@ tags: - All_Changes.action - All_Changes.user - All_Changes.vendor_region - risk_score: 18 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index f82159d345..f0813bb376 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -40,7 +40,6 @@ tags: - All_Changes.action - All_Changes.vendor_region - All_Changes.user - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 89e00c36b8..281a1b7f3d 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -38,7 +38,6 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.image_id - All_Changes.user - risk_score: 36 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 6f8e8887c2..d69c6f5c0a 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -38,7 +38,6 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.instance_type - All_Changes.user - risk_score: 30 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 960bb0459d..ce76da87a2 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -39,7 +39,6 @@ tags: - All_Changes.change_type - All_Changes.status - All_Changes.user - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 13374f7dd0..80a96ba04f 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -57,7 +57,6 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_score: 18 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup tests: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index 35b73ffa52..82d75e5a12 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -57,7 +57,6 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_score: 42 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup tests: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index d49109dfd1..93850f01e4 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -57,7 +57,6 @@ tags: - All_Changes.src - All_Changes.user - All_Changes.command - risk_score: 42 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup tests: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index f712bd6c58..775cad9873 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -57,7 +57,6 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_score: 42 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup tests: diff --git a/detections/cloud/cloud_security_groups_modifications_by_user.yml b/detections/cloud/cloud_security_groups_modifications_by_user.yml index c7d6fe6905..9513dfe4a8 100644 --- a/detections/cloud/cloud_security_groups_modifications_by_user.yml +++ b/detections/cloud/cloud_security_groups_modifications_by_user.yml @@ -47,7 +47,6 @@ tags: - All_Changes.status - All_Changes.object_category - All_Changes.user - risk_score: 35 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index a96fcb94aa..535d94b0b4 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -37,7 +37,6 @@ tags: - _time - Authentication.signature - Authentication.user - risk_score: 30 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 5ed4a0207d..c4bb110942 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -40,7 +40,6 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_score: 18 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated. tests: diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 8466e0d5ae..7384e2e3ab 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -40,7 +40,6 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_score: 42 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated. tests: diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 4a894e1c9f..60b67b16cd 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -40,7 +40,6 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_score: 36 security_domain: threat manual_test: This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated. tests: diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml index 4b2339b3b9..5fb56a5a12 100644 --- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -36,5 +36,4 @@ tags: - c_ip_ - cs_uri_ - cs_method_ - risk_score: 25 security_domain: network diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml index a1c5254caf..5f7356274a 100644 --- a/detections/cloud/detect_new_open_gcp_storage_buckets.yml +++ b/detections/cloud/detect_new_open_gcp_storage_buckets.yml @@ -40,5 +40,4 @@ tags: - data.protoPayload.resourceName - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member - risk_score: 25 security_domain: network diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 4b9ade8b3b..7d8992795e 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -53,7 +53,6 @@ tags: - userAgent - uri - permission - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 475d944eea..2aa6f15560 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -52,7 +52,6 @@ tags: - userIdentity.principalId - userAgent - bucketName - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index bccbc3af83..8510bb6d60 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -47,7 +47,6 @@ tags: - vendor_region - severity - dest - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index 5d7abde51e..c1eeaf8491 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -34,5 +34,4 @@ tags: - findings{}.Resources{}.Type - indings{}.Resources{}.Id - user - risk_score: 25 security_domain: network diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml index 606d5295f5..10d0692f6f 100644 --- a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml +++ b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml @@ -34,5 +34,4 @@ tags: - _time - eventName - userIdentity.arn - risk_score: 25 security_domain: network diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml index ce94457b13..fe3e5cc0fe 100644 --- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml @@ -55,7 +55,6 @@ tags: - src_ip - login_challenge_method - event.parameters{}.multiValue{} - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml index 30946b5976..84b20f6802 100644 --- a/detections/cloud/gcp_detect_gcploit_framework.yml +++ b/detections/cloud/gcp_detect_gcploit_framework.yml @@ -41,5 +41,4 @@ tags: - data.protoPayload.authorizationInfo{}.permission - data.protoPayload.request.location - http_user_agent - risk_score: 25 security_domain: threat diff --git a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml index 5109661316..0149a23e30 100644 --- a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml +++ b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -39,5 +39,4 @@ tags: - requestURI - responseStatus.reason - properties.pod - risk_score: 25 security_domain: threat diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index 1620bdefa7..fc2f37f43e 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -55,7 +55,6 @@ tags: - user - command - status - risk_score: 45 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index 5bc9eec942..b2d049f054 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -54,7 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 63db748127..444757d0e9 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -59,7 +59,6 @@ tags: - app - id.applicationName - src - risk_score: 54 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index a3ad84eaea..6235b53fb8 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -56,7 +56,6 @@ tags: - user - src_ip - login_challenge_method - risk_score: 45 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index f2cbee410e..5f169dae15 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -57,7 +57,6 @@ tags: - src - event.type - user_name - risk_score: 54 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/gdrive_suspicious_file_sharing.yml b/detections/cloud/gdrive_suspicious_file_sharing.yml index 7474c49123..c338860bc5 100644 --- a/detections/cloud/gdrive_suspicious_file_sharing.yml +++ b/detections/cloud/gdrive_suspicious_file_sharing.yml @@ -38,5 +38,4 @@ tags: - parameters.target_user - parameters.doc_title - parameters.doc_type - risk_score: 25 security_domain: threat diff --git a/detections/cloud/github_actions_disable_security_workflow.yml b/detections/cloud/github_actions_disable_security_workflow.yml index 8b78e52e92..1844ccadcc 100644 --- a/detections/cloud/github_actions_disable_security_workflow.yml +++ b/detections/cloud/github_actions_disable_security_workflow.yml @@ -54,7 +54,6 @@ tags: - workflow_run.head_repository.owner.id - workflow_run.head_repository.owner.login - workflow_run.head_repository.owner.type - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 0b4dfdad1e..f717346c05 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -42,7 +42,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 7e50ba10a1..5a76f2a49e 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -42,7 +42,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index e8e0626850..91e136c9e6 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -54,7 +54,6 @@ tags: - alert.external_reference - alert.fixed_in - alert.severity - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index fceb64ab77..28e5805e3f 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -54,7 +54,6 @@ tags: - alert.external_reference - alert.fixed_in - alert.severity - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 3e317d4b19..ddc0e7cc28 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -46,7 +46,6 @@ tags: - parameters.visibility - parameters.owner - parameters.doc_type - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 363b494a92..1e6b1ceca4 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -55,7 +55,6 @@ tags: - subject - destination{}.address - source.address - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index 3576d818d8..f690cdc4bc 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -48,7 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index c46a891b53..8e838e8530 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -47,7 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index 18550c4d68..24da353a0a 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -45,7 +45,6 @@ tags: - dest_domain - phase - severity - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/gsuite_suspicious_calendar_invite.yml b/detections/cloud/gsuite_suspicious_calendar_invite.yml index 7cdf511a80..a20878c80e 100644 --- a/detections/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/cloud/gsuite_suspicious_calendar_invite.yml @@ -37,5 +37,4 @@ tags: - parameters.event_title - parameters.target_calendar_id - parameters.event_title - risk_score: 25 security_domain: threat diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index dab42e8b75..2e9e9932c0 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -55,7 +55,6 @@ tags: - parameters.visibility - parameters.owner - parameters.doc_type - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml index 60042df478..1aef3d3232 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -60,7 +60,6 @@ tags: - UserAgent - src_ip - record_type - risk_score: 25 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml index 690001002c..268dac178c 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml index 2708207fdf..f4c92505eb 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml index 2bea11aa69..781b1ccd5e 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml index 19d9174b1a..ec1b0ba542 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_access_scanning.yml b/detections/cloud/kubernetes_access_scanning.yml index 9a518a2606..04646cf2d5 100644 --- a/detections/cloud/kubernetes_access_scanning.yml +++ b/detections/cloud/kubernetes_access_scanning.yml @@ -56,7 +56,6 @@ tags: - verb - responseStatus.reason - responseStatus.status - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml b/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml index 47a0a09794..dffb768cc7 100644 --- a/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml +++ b/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml @@ -40,5 +40,4 @@ tags: - k8s.cluster.name - dest.process.name - dest.workload.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml index 4abba838f5..ab2edbcb8a 100644 --- a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml +++ b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - k8s.pod.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml index 27a409f186..50d679b840 100644 --- a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml +++ b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - k8s.pod.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml b/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml index 73183c00cc..53f7abf9f6 100644 --- a/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml +++ b/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml @@ -41,5 +41,4 @@ tags: - source.workload.name - dest.workload.name - udp.packets - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml b/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml index 0e0076f2f3..41d3294198 100644 --- a/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml +++ b/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml @@ -41,5 +41,4 @@ tags: - source.workload.name - dest.workload.name - udp.packets - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index 857ba3304f..e81b698d32 100644 --- a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -43,5 +43,4 @@ tags: - user.username - userAgent - verb - risk_score: 25 security_domain: threat diff --git a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml index 5ce9e74632..6f6136afd6 100644 --- a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml +++ b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml @@ -59,7 +59,6 @@ tags: - userAgent - verb - requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_cron_job_creation.yml b/detections/cloud/kubernetes_cron_job_creation.yml index 178ab06275..c74feeb6c2 100644 --- a/detections/cloud/kubernetes_cron_job_creation.yml +++ b/detections/cloud/kubernetes_cron_job_creation.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_daemonset_deployed.yml b/detections/cloud/kubernetes_daemonset_deployed.yml index 4e9384e1b1..1755f03692 100644 --- a/detections/cloud/kubernetes_daemonset_deployed.yml +++ b/detections/cloud/kubernetes_daemonset_deployed.yml @@ -57,7 +57,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_falco_shell_spawned.yml b/detections/cloud/kubernetes_falco_shell_spawned.yml index 6f1f7714bc..cc9605a6ae 100644 --- a/detections/cloud/kubernetes_falco_shell_spawned.yml +++ b/detections/cloud/kubernetes_falco_shell_spawned.yml @@ -48,7 +48,6 @@ tags: - proc_exepath - process - user - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_newly_seen_tcp_edge.yml b/detections/cloud/kubernetes_newly_seen_tcp_edge.yml index 13fce7809a..8e5c1cc92f 100644 --- a/detections/cloud/kubernetes_newly_seen_tcp_edge.yml +++ b/detections/cloud/kubernetes_newly_seen_tcp_edge.yml @@ -39,5 +39,4 @@ tags: - source.workload.name - dest.workload.name - tcp.packets - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_newly_seen_udp_edge.yml b/detections/cloud/kubernetes_newly_seen_udp_edge.yml index ca3826ab0f..7e7a7eec5d 100644 --- a/detections/cloud/kubernetes_newly_seen_udp_edge.yml +++ b/detections/cloud/kubernetes_newly_seen_udp_edge.yml @@ -39,5 +39,4 @@ tags: - source.workload.name - dest.workload.name - udp.packets - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 52b172d819..6d5faf3966 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -46,7 +46,6 @@ tags: - Splunk Cloud required_fields: - raw - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml index 4e908f9bcf..52aee47562 100644 --- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -46,7 +46,6 @@ tags: - Splunk Cloud required_fields: - raw - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_node_port_creation.yml b/detections/cloud/kubernetes_node_port_creation.yml index c9e3f04320..df23bbc02e 100644 --- a/detections/cloud/kubernetes_node_port_creation.yml +++ b/detections/cloud/kubernetes_node_port_creation.yml @@ -58,7 +58,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml index b494872b13..ee30e901cf 100644 --- a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml +++ b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml @@ -59,7 +59,6 @@ tags: - user.username - userAgent - verb - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml index 925c8e0244..f0cbf3cf4d 100644 --- a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml +++ b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml @@ -59,7 +59,6 @@ tags: - userAgent - verb - requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml index de747c5918..776f509e19 100644 --- a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml +++ b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml @@ -57,5 +57,4 @@ tags: - host.name - k8s.cluster.name - k8s.node.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_previously_unseen_process.yml b/detections/cloud/kubernetes_previously_unseen_process.yml index e135818a44..f817e5c7d3 100644 --- a/detections/cloud/kubernetes_previously_unseen_process.yml +++ b/detections/cloud/kubernetes_previously_unseen_process.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.executable.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_process_running_from_new_path.yml b/detections/cloud/kubernetes_process_running_from_new_path.yml index b38bdbae28..ffc4da7b50 100644 --- a/detections/cloud/kubernetes_process_running_from_new_path.yml +++ b/detections/cloud/kubernetes_process_running_from_new_path.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.executable.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml index 4c91315a64..300ef634d1 100644 --- a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml +++ b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.executable.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml index a17505403f..e19222a8c0 100644 --- a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml +++ b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml @@ -58,5 +58,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.executable.name - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index f3f167b7cd..a0b86d1f18 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -47,7 +47,6 @@ tags: - object.involvedObject.kind - object.message - object.reason - risk_score: 81 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml index 125dc24ea3..dea13b3cc2 100644 --- a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml +++ b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml @@ -56,7 +56,6 @@ tags: - verb - responseStatus.reason - responseStatus.status - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node.yml b/detections/cloud/kubernetes_shell_running_on_worker_node.yml index b3892a118e..e8f1f9b96b 100644 --- a/detections/cloud/kubernetes_shell_running_on_worker_node.yml +++ b/detections/cloud/kubernetes_shell_running_on_worker_node.yml @@ -60,5 +60,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.pid - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml index c99c2d7139..8d2063b099 100644 --- a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml +++ b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml @@ -60,5 +60,4 @@ tags: - k8s.cluster.name - k8s.node.name - process.pid - risk_score: 25 security_domain: network diff --git a/detections/cloud/kubernetes_suspicious_image_pulling.yml b/detections/cloud/kubernetes_suspicious_image_pulling.yml index 0788cc43cd..faddaab806 100644 --- a/detections/cloud/kubernetes_suspicious_image_pulling.yml +++ b/detections/cloud/kubernetes_suspicious_image_pulling.yml @@ -56,7 +56,6 @@ tags: - verb - responseStatus.reason - responseStatus.status - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/kubernetes_unauthorized_access.yml b/detections/cloud/kubernetes_unauthorized_access.yml index 823255c842..3cfc20d5d1 100644 --- a/detections/cloud/kubernetes_unauthorized_access.yml +++ b/detections/cloud/kubernetes_unauthorized_access.yml @@ -56,7 +56,6 @@ tags: - verb - responseStatus.reason - responseStatus.status - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 447d408f9c..442831f4a3 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -56,7 +56,6 @@ tags: - UserId - dest - ResultStatus - risk_score: 18 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 75ecee1d77..09b03aa9ef 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -55,7 +55,6 @@ tags: - action - Operation - authentication_service - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml index ae7dba3eb8..211e7a2a37 100644 --- a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml +++ b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml @@ -53,7 +53,6 @@ tags: - ModifiedProperties{}.NewValue - src_user - dest_user - risk_score: 54 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_advanced_audit_disabled.yml b/detections/cloud/o365_advanced_audit_disabled.yml index e46058734e..944ff0f14d 100644 --- a/detections/cloud/o365_advanced_audit_disabled.yml +++ b/detections/cloud/o365_advanced_audit_disabled.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 32 required_fields: - _time - Operation diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml index 5eec413e79..7cc0b28111 100644 --- a/detections/cloud/o365_application_available_to_other_tenants.yml +++ b/detections/cloud/o365_application_available_to_other_tenants.yml @@ -57,7 +57,6 @@ tags: - UserId - Workload - Target{}.ID - risk_score: 50 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_application_registration_owner_added.yml b/detections/cloud/o365_application_registration_owner_added.yml index a3051338f4..6efb9881ba 100644 --- a/detections/cloud/o365_application_registration_owner_added.yml +++ b/detections/cloud/o365_application_registration_owner_added.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - time - Workload diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml index 752dae0b2b..d6a70ee918 100644 --- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml +++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 56 required_fields: - _time - Workload diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml index 950904c721..b6db618be5 100644 --- a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml +++ b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - Workload diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index a299a27eab..64aece0669 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -58,7 +58,6 @@ tags: - status - user_id - action - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_compliance_content_search_exported.yml b/detections/cloud/o365_compliance_content_search_exported.yml index a574fb11a8..2b386f9034 100644 --- a/detections/cloud/o365_compliance_content_search_exported.yml +++ b/detections/cloud/o365_compliance_content_search_exported.yml @@ -51,7 +51,6 @@ tags: - ExchangeLocations - Query - user_id - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_compliance_content_search_started.yml b/detections/cloud/o365_compliance_content_search_started.yml index 664bb9390a..4ca9f99fcb 100644 --- a/detections/cloud/o365_compliance_content_search_started.yml +++ b/detections/cloud/o365_compliance_content_search_started.yml @@ -51,7 +51,6 @@ tags: - ExchangeLocations - Query - user_id - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml index ed89c8268f..8745d1d6a6 100644 --- a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml @@ -53,7 +53,6 @@ tags: - src_ip - user - user_agent - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index 3cf427f322..22495a13c0 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -54,7 +54,6 @@ tags: - ModifiedProperties{}.Name - UserId - Workload - risk_score: 75 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 0def1549eb..2194249603 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -49,7 +49,6 @@ tags: - signature - dest - ResultStatus - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index bcb32a9ba3..4232c87ddf 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -55,7 +55,6 @@ tags: - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName - PolicyDetails{}.Rules{}.Actions{} - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location - risk_score: 20 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml index acf769c285..6b4086b0fb 100644 --- a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml +++ b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml @@ -50,7 +50,6 @@ tags: - user - src_user - dest_user - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index ef2bfd498a..671ce8f689 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -59,7 +59,6 @@ tags: - MailboxId - InternetMessageId - UserId - risk_score: 25 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 91581c52fe..bf8b6cdeb7 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -56,7 +56,6 @@ tags: - Id - Operation - UserId - risk_score: 50 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 5028496a5a..181e947d7c 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -61,7 +61,6 @@ tags: - AlertEntityId - tsd - etps - risk_score: 75 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index ef1b501212..7e5dcfe3b9 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -50,7 +50,6 @@ tags: - UserId - Operation - Workload - risk_score: 25 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index f6040c0403..877fe71e8a 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -50,7 +50,6 @@ tags: - Operation - Name - Workload - risk_score: 90 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index e54e26d134..0328df1cef 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -51,7 +51,6 @@ tags: - UserAgent - src_ip - user - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 16596fc2bf..cfd32039e9 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -57,7 +57,6 @@ tags: - authentication_service - authentication_method - Operation - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index bf5f60864d..474ae293af 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -55,7 +55,6 @@ tags: - UserId - Id - Workload - risk_score: 25 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_external_identity_policy_changed.yml b/detections/cloud/o365_external_identity_policy_changed.yml index 068b20814a..24abbbdb83 100644 --- a/detections/cloud/o365_external_identity_policy_changed.yml +++ b/detections/cloud/o365_external_identity_policy_changed.yml @@ -48,7 +48,6 @@ tags: - ModifiedProperties{}.Name - UserId - Workload - risk_score: 75 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml index a0cd7652b3..28253bbd14 100644 --- a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 40 required_fields: - _time - Workload diff --git a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml index 325050edd8..ea38de0dad 100644 --- a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml +++ b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 48 required_fields: - _time - Workload diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml index a4a8b48347..734d3f1d42 100644 --- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 35 required_fields: - _time - src_ip diff --git a/detections/cloud/o365_high_privilege_role_granted.yml b/detections/cloud/o365_high_privilege_role_granted.yml index df073ddb0a..36f639ef26 100644 --- a/detections/cloud/o365_high_privilege_role_granted.yml +++ b/detections/cloud/o365_high_privilege_role_granted.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 48 required_fields: - _time - Operation diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml index 594c9a1248..cf6e96a7b7 100644 --- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 40 required_fields: - _time - Workload diff --git a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml index 30b0618fee..af00a7465b 100644 --- a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml +++ b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml @@ -48,7 +48,6 @@ tags: - src_user - DeliverToMailboxAndForward - ObjectId - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml index 67172ac2aa..7ce36b1a66 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml @@ -49,7 +49,6 @@ tags: - UserId - object - Item.ParentFolder.MemberRights - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml index 79288005d8..c74e3c2d81 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml @@ -49,7 +49,6 @@ tags: - UserId - Identity - User - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml index ea56897f58..e300bfd1a7 100644 --- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml +++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 56 required_fields: - _time - Operation diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml index 1259e0e4d7..5d4da5e9be 100644 --- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml +++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - Operation - _time diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml index fb433e0003..badbfe8d09 100644 --- a/detections/cloud/o365_multi_source_failed_authentications_spike.yml +++ b/detections/cloud/o365_multi_source_failed_authentications_spike.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 42 required_fields: - _time - Workload diff --git a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml index 304455b896..2177097e3d 100644 --- a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml +++ b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 48 required_fields: - _time - Workload diff --git a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml index bf554c3746..ca01dd2bad 100644 --- a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 48 required_fields: - _time - Workload diff --git a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml index 9bef583fad..fa8430370f 100644 --- a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml +++ b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml @@ -55,7 +55,6 @@ tags: - ClientInfoString - ClientIPAddress - user - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml index 58f45dcc87..e0d42c069f 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml @@ -49,7 +49,6 @@ tags: - Actor{}.ID - src_user - object - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_multiple_service_principals_created_by_user.yml b/detections/cloud/o365_multiple_service_principals_created_by_user.yml index f4dbd4ac6c..567201b566 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_user.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_user.yml @@ -49,7 +49,6 @@ tags: - Actor{}.ID - src_user - object - risk_score: 42 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml index 2e405cbcb8..d0889b11cc 100644 --- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml @@ -52,7 +52,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 63 required_fields: - _time - Workload diff --git a/detections/cloud/o365_new_email_forwarding_rule_created.yml b/detections/cloud/o365_new_email_forwarding_rule_created.yml index 5f08054421..83dac5ffc0 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_created.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_created.yml @@ -47,7 +47,6 @@ tags: - Name - user - UserId - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml index 1697760b48..8ec8ae84c6 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml @@ -46,7 +46,6 @@ tags: - Actions - Name - user - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 429a39b7ea..0771b6fa46 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -55,7 +55,6 @@ tags: - user - user_agent - action - risk_score: 64 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml index 85ed1f33d3..f804e06525 100644 --- a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml +++ b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml @@ -47,7 +47,6 @@ tags: - Parameters{}.Name - user - Name - risk_score: 42 security_domain: audit tests: - name: True Positive Test diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index d048cad3cf..2d1943a1df 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - Workload diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml index e8ffd9ae71..d42a394727 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml @@ -50,7 +50,6 @@ tags: - AppId - ClientAppId - OperationCount - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml index f4cef3f577..4a8919ac8b 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml @@ -50,7 +50,6 @@ tags: - AppId - ClientAppId - OperationCount - risk_score: 42 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml index 82fcdc96a7..ede1699fdc 100644 --- a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml +++ b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 54 required_fields: - _time - Workload diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index ab7c208b1d..b83fcf3d93 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -55,7 +55,6 @@ tags: - UserId - ObjectId - Workload - risk_score: 75 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 23d21f6386..0b92036b0f 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -56,7 +56,6 @@ tags: - UserId - ObjectId - Workload - risk_score: 75 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index e6890351e9..005138ae32 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -49,7 +49,6 @@ tags: - Severity - AlertEntityId - Operation - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index 977416fee7..65b3a05779 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -55,7 +55,6 @@ tags: - AlertId - trc - ot - risk_score: 40 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_security_and_compliance_alert_triggered.yml b/detections/cloud/o365_security_and_compliance_alert_triggered.yml index 3f63413842..7efe3cb934 100644 --- a/detections/cloud/o365_security_and_compliance_alert_triggered.yml +++ b/detections/cloud/o365_security_and_compliance_alert_triggered.yml @@ -49,7 +49,6 @@ tags: - Operation - Name - Data - risk_score: 48 security_domain: identity tests: - name: True Positive Test diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 4adc23b23f..17e44877e2 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 35 required_fields: - _time - Workload diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 1a5827709f..7e138a7fc4 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -50,7 +50,6 @@ tags: - UserId - ModifiedProperties{}.NewValue - ModifiedProperties{}.OldValue - risk_score: 75 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index 8f44f69423..00421a8623 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -60,7 +60,6 @@ tags: - VirusInfo - Id - UserId - risk_score: 75 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml index 10626951b3..e73158a9d1 100644 --- a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml +++ b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Operation diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index f2ed2dcc5b..db5cff89d6 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -60,7 +60,6 @@ tags: - DeliveryAction - Operation - Workload - risk_score: 20 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index 0b74f9b17d..5fd564bc68 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -58,7 +58,6 @@ tags: - Operation - Id - UserId - risk_score: 50 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml index f2f14f85f0..1007ddfa8f 100644 --- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - Workload diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml index bbe450fbe9..b9c6afe8d2 100644 --- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 30 required_fields: - _time - status.errorCode diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index 8a676ba6d3..219f631d02 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -62,7 +62,6 @@ tags: - Name - Data - AlertId - risk_score: 10 security_domain: threat tests: - name: True Positive Test diff --git a/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml b/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml index 48d79021a3..3363b36cb8 100644 --- a/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml +++ b/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml @@ -41,7 +41,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 70 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index 4f19cf183c..4dfb7c49fa 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -49,5 +49,4 @@ tags: - eventName - errorCode - userName - risk_score: 25 security_domain: network diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index c05b11bc3f..49466d303c 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -44,5 +44,4 @@ tags: - eventName - errorCode - src_user - risk_score: 25 security_domain: network diff --git a/detections/deprecated/asl_aws_createaccesskey.yml b/detections/deprecated/asl_aws_createaccesskey.yml index 477f384c24..51a2656cdb 100644 --- a/detections/deprecated/asl_aws_createaccesskey.yml +++ b/detections/deprecated/asl_aws_createaccesskey.yml @@ -75,7 +75,6 @@ tags: - src_endpoint.ip - unmapped{}.key - unmapped{}.value - risk_score: 63 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/asl_aws_excessive_security_scanning.yml b/detections/deprecated/asl_aws_excessive_security_scanning.yml index fdda20b3e0..1d290c888e 100644 --- a/detections/deprecated/asl_aws_excessive_security_scanning.yml +++ b/detections/deprecated/asl_aws_excessive_security_scanning.yml @@ -46,5 +46,4 @@ tags: - identity.user.name - http_request.user_agent - src_endpoint.ip - risk_score: 18 security_domain: network \ No newline at end of file diff --git a/detections/deprecated/asl_aws_password_policy_changes.yml b/detections/deprecated/asl_aws_password_policy_changes.yml index 1a66d779cf..fac3ce315d 100644 --- a/detections/deprecated/asl_aws_password_policy_changes.yml +++ b/detections/deprecated/asl_aws_password_policy_changes.yml @@ -58,7 +58,6 @@ tags: - identity.user.uuid - http_request.user_agent - src_endpoint.ip - risk_score: 72 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index c647d388b3..e848410413 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -60,5 +60,4 @@ tags: - _time - eventName - sourceIPAddress - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index 7a6ad8bddf..3470a62a3d 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -61,5 +61,4 @@ tags: - _time - eventName - sourceIPAddress - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 145370cb23..396638accb 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -58,5 +58,4 @@ tags: - _time - eventName - sourceIPAddress - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index 9dfc9679ef..01ea187454 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -64,5 +64,4 @@ tags: - _time - eventName - sourceIPAddress - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml b/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml index 9383a5975a..442a7afa48 100644 --- a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml +++ b/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml index c34d8a2bb0..9b02fc2b56 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml @@ -55,5 +55,4 @@ tags: - DNS.dest - DNS.message_type - DNS.src - risk_score: 25 security_domain: network diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/detections/deprecated/cloud_network_access_control_list_deleted.yml index 37556f398f..a3fa25a4fc 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/detections/deprecated/cloud_network_access_control_list_deleted.yml @@ -48,5 +48,4 @@ tags: - src - userName - arn - risk_score: 25 security_domain: network diff --git a/detections/deprecated/correlation_by_repository_and_risk.yml b/detections/deprecated/correlation_by_repository_and_risk.yml index ef3930edee..7daf2527d2 100644 --- a/detections/deprecated/correlation_by_repository_and_risk.yml +++ b/detections/deprecated/correlation_by_repository_and_risk.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 70 security_domain: network diff --git a/detections/deprecated/correlation_by_user_and_risk.yml b/detections/deprecated/correlation_by_user_and_risk.yml index 582d10159d..2b92b67a45 100644 --- a/detections/deprecated/correlation_by_user_and_risk.yml +++ b/detections/deprecated/correlation_by_user_and_risk.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 70 security_domain: network diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml index 5ee8df78d5..e18fd4a2f4 100644 --- a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml @@ -53,7 +53,6 @@ tags: - WorkstationName - user - dest - risk_score: 49 security_domain: access tests: - name: True Positive Test diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index ed39395ce8..101896f340 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -65,5 +65,4 @@ tags: - DNS.src - DNS.query - host - risk_score: 25 security_domain: network diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/detections/deprecated/detect_long_dns_txt_record_response.yml index 0ee750d14d..a02ceba4ca 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/detections/deprecated/detect_long_dns_txt_record_response.yml @@ -55,5 +55,4 @@ tags: - DNS.src - DNS.dest - DNS.answer - risk_score: 25 security_domain: network diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index 82d0f52559..26259ab821 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -62,7 +62,6 @@ tags: - ProcessId - dest - Image - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index 3ea450633d..81e8da74c5 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -51,5 +51,4 @@ tags: - Message - dest - Process_ID - risk_score: 25 security_domain: access diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index 0c539bc079..655b952eb8 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -49,5 +49,4 @@ tags: - _time - eventName - userIdentity.arn - risk_score: 25 security_domain: network diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/detections/deprecated/detect_usb_device_insertion.yml index db90a65dd1..82b74d05c9 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/detections/deprecated/detect_usb_device_insertion.yml @@ -48,5 +48,4 @@ tags: - All_Changes.result_id - All_Changes.src_priority - All_Changes.dest - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 461584c0ff..5e4f3972ba 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -57,5 +57,4 @@ tags: - Web.status - Web.src - Web.dest - risk_score: 25 security_domain: network diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index a892c3f878..37cf95b31c 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -70,5 +70,4 @@ tags: - DNS.message_type - DNS.src_category - DNS.src - risk_score: 25 security_domain: network diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index 5e629764f5..452db42510 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -46,5 +46,4 @@ tags: - DNS.src_category - DNS.src - DNS.dest - risk_score: 25 security_domain: network diff --git a/detections/deprecated/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml index 86d8f9a32d..c80e1ad5a0 100644 --- a/detections/deprecated/dns_record_changed.yml +++ b/detections/deprecated/dns_record_changed.yml @@ -63,5 +63,4 @@ tags: - DNS.src - DNS.message_type - DNS.query - risk_score: 25 security_domain: network diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml index 855f6eb447..eafafd68f9 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -65,5 +65,4 @@ tags: - CommandLine - dest - parent_process_name - risk_score: 80 security_domain: endpoint diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml index 1079fb6ecd..84a8377b88 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml @@ -49,5 +49,4 @@ tags: - eventName - errorCode - requestParameters.instancesSet.items{}.imageId - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml index cfcf851d26..08a5c39246 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -49,5 +49,4 @@ tags: - eventName - errorCode - requestParameters.instanceType - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml index d7c889af4d..f93ac86b86 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml @@ -50,5 +50,4 @@ tags: - eventName - errorCode - userIdentity.arn - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml index 81d0c1dfc1..9fea7507cf 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml @@ -52,5 +52,4 @@ tags: - Processes.dest - Processes.user - Processes.process_name - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml index c69fd4d11c..5087770ffd 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml @@ -40,5 +40,4 @@ tags: - _time - MESSAGE - COMPUTERNAME - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/detections/deprecated/first_time_seen_command_line_argument.yml index 6f2f93c141..2d49c269ce 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/detections/deprecated/first_time_seen_command_line_argument.yml @@ -64,5 +64,4 @@ tags: - Processes.process - Processes.parent_process_name - Processes.dest - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml index fa2a7afa38..245e501758 100644 --- a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -51,5 +51,4 @@ tags: - data.protoPayload.authorizationInfo{}.resource - data.protoPayload.response.bindings{}.role - data.protoPayload.response.bindings{}.members{} - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 2e08af647c..036c33c96b 100644 --- a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -50,5 +50,4 @@ tags: - data.protoPayload.authorizationInfo{}.permission - data.protoPayload.response.bindings{}.members{} - data.resource.labels.project_id - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/gcp_detect_oauth_token_abuse.yml b/detections/deprecated/gcp_detect_oauth_token_abuse.yml index 6571a5fe9e..96a9506193 100644 --- a/detections/deprecated/gcp_detect_oauth_token_abuse.yml +++ b/detections/deprecated/gcp_detect_oauth_token_abuse.yml @@ -40,5 +40,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml index 82b0c7452c..187f63a006 100644 --- a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml +++ b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml @@ -44,5 +44,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/identify_new_user_accounts.yml b/detections/deprecated/identify_new_user_accounts.yml index 751871c2a8..ded795bbb5 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/detections/deprecated/identify_new_user_accounts.yml @@ -39,5 +39,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: access diff --git a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index 96583b21a3..4145d19dae 100644 --- a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -34,5 +34,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml index 00ddb8c2c3..8a75adab26 100644 --- a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat \ No newline at end of file diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml index 29ef8de65e..1416f7aa86 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index 344bfa7d85..ed4367a905 100644 --- a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml index cc6f35af8d..00e5f375c9 100644 --- a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml +++ b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml index 2eb82e151b..b2c28dbcfd 100644 --- a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml index 44c2dc672f..a5c11afeb1 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml index f882bd700a..1d80320e46 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index b9231eb62b..96c0b75a57 100644 --- a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml index 41181a8aff..9a06dad276 100644 --- a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -38,5 +38,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml index 6ed545867f..3b57b7ec9c 100644 --- a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml index 910b36c4bf..de319eab32 100644 --- a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml @@ -37,5 +37,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index bc40619269..33aa56960e 100644 --- a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml b/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml index 7d5af8b4a6..6b759872cd 100644 --- a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml index 7cdbc43651..7372ad6241 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml index 9bcd081b67..ad75ae7237 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index fb104b1612..b1c84d451e 100644 --- a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -38,5 +38,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index c0fd76eb6b..bdbee2761d 100644 --- a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -37,5 +37,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index aeb1119c9c..e4b52ee53a 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -43,5 +43,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: network diff --git a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml index dd8ef0e990..70e38437f5 100644 --- a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml +++ b/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml @@ -59,7 +59,6 @@ tags: - displayMessage - eventType - outcome.result - risk_score: 9 security_domain: access tests: - name: True Positive Test diff --git a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml b/detections/deprecated/o365_suspicious_admin_email_forwarding.yml index 2476713d4c..ea3c6933fb 100644 --- a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml +++ b/detections/deprecated/o365_suspicious_admin_email_forwarding.yml @@ -44,7 +44,6 @@ tags: - _time - Operation - Parameters - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/o365_suspicious_rights_delegation.yml b/detections/deprecated/o365_suspicious_rights_delegation.yml index fcc6cd4f44..ae97726e02 100644 --- a/detections/deprecated/o365_suspicious_rights_delegation.yml +++ b/detections/deprecated/o365_suspicious_rights_delegation.yml @@ -45,7 +45,6 @@ tags: - _time - Operation - Parameters - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/o365_suspicious_user_email_forwarding.yml b/detections/deprecated/o365_suspicious_user_email_forwarding.yml index 2855f74738..aa8b76403e 100644 --- a/detections/deprecated/o365_suspicious_user_email_forwarding.yml +++ b/detections/deprecated/o365_suspicious_user_email_forwarding.yml @@ -47,7 +47,6 @@ tags: - _time - Operation - Parameters - risk_score: 48 security_domain: threat tests: - name: True Positive Test diff --git a/detections/deprecated/okta_account_locked_out.yml b/detections/deprecated/okta_account_locked_out.yml index d7a30ee439..9084f592ee 100644 --- a/detections/deprecated/okta_account_locked_out.yml +++ b/detections/deprecated/okta_account_locked_out.yml @@ -46,7 +46,6 @@ tags: - src_ip - eventType - status - risk_score: 64 security_domain: access tests: - name: True Positive Test diff --git a/detections/deprecated/okta_account_lockout_events.yml b/detections/deprecated/okta_account_lockout_events.yml index 4d15cada48..64d2d76c55 100644 --- a/detections/deprecated/okta_account_lockout_events.yml +++ b/detections/deprecated/okta_account_lockout_events.yml @@ -56,7 +56,6 @@ tags: - client.geographicalContext.city - src_ip - src_user - risk_score: 25 security_domain: access tests: - name: True Positive Test diff --git a/detections/deprecated/okta_failed_sso_attempts.yml b/detections/deprecated/okta_failed_sso_attempts.yml index a6b0768935..275f362f0e 100644 --- a/detections/deprecated/okta_failed_sso_attempts.yml +++ b/detections/deprecated/okta_failed_sso_attempts.yml @@ -43,5 +43,4 @@ tags: - src_user - result - src_ip - risk_score: 16 security_domain: access diff --git a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml b/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml index 0c308a051f..49a3f30c6a 100644 --- a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml +++ b/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml @@ -45,5 +45,4 @@ tags: - client.userAgent.browser - outcome.reason - displayMessage - risk_score: 50 security_domain: access diff --git a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml b/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml index 9ca05aa50e..428aa1f0b9 100644 --- a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml @@ -46,5 +46,4 @@ tags: - client.userAgent.browser - outcome.reason - displayMessage - risk_score: 60 security_domain: access diff --git a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml b/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml index 054e1f73d3..ef56c2379a 100644 --- a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml @@ -53,5 +53,4 @@ tags: - src_ip - eventType - status - risk_score: 64 security_domain: access diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index b135fd565c..899aa6da1b 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -39,5 +39,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/processes_created_by_netsh.yml b/detections/deprecated/processes_created_by_netsh.yml index c5a02ce2ee..78a13738c4 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/detections/deprecated/processes_created_by_netsh.yml @@ -57,5 +57,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/detections/deprecated/prohibited_software_on_endpoint.yml index 03473629ef..c638c22a9e 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/detections/deprecated/prohibited_software_on_endpoint.yml @@ -48,5 +48,4 @@ tags: - Splunk Cloud required_fields: - _times - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index 085db48699..1bb0c0f7ee 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -52,5 +52,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/detections/deprecated/remote_registry_key_modifications.yml index 9bd274acf5..82c198f20d 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/detections/deprecated/remote_registry_key_modifications.yml @@ -45,5 +45,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml index 5733207051..4cc52e9d99 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -51,5 +51,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml index 5a50ca1bbf..170a5c2438 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml @@ -38,5 +38,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/detections/deprecated/suspicious_changes_to_file_associations.yml index e18aeb3d9e..d9c267da33 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/detections/deprecated/suspicious_changes_to_file_associations.yml @@ -53,5 +53,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/suspicious_email___uba_anomaly.yml b/detections/deprecated/suspicious_email___uba_anomaly.yml index 95611cc4b1..9e3ded2ed7 100644 --- a/detections/deprecated/suspicious_email___uba_anomaly.yml +++ b/detections/deprecated/suspicious_email___uba_anomaly.yml @@ -45,5 +45,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/suspicious_file_write.yml b/detections/deprecated/suspicious_file_write.yml index 52be4ad801..be6dff04f9 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/detections/deprecated/suspicious_file_write.yml @@ -47,5 +47,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index 29dc289399..bc425f1d51 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -58,5 +58,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/detections/deprecated/suspicious_rundll32_rename.yml index 0be18969d9..95fb4a5c9f 100644 --- a/detections/deprecated/suspicious_rundll32_rename.yml +++ b/detections/deprecated/suspicious_rundll32_rename.yml @@ -73,5 +73,4 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/detections/deprecated/suspicious_writes_to_system_volume_information.yml index 9db993173f..0c657c1c67 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/detections/deprecated/suspicious_writes_to_system_volume_information.yml @@ -40,5 +40,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index cd005e9758..70fa651d45 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -46,5 +46,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index abad39d5ec..503f8317a6 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -43,5 +43,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/detections/deprecated/unsuccessful_netbackup_backups.yml index 2a8da81803..4c29a6c890 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/detections/deprecated/unsuccessful_netbackup_backups.yml @@ -36,5 +36,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml index ff403542db..0b84c251e4 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/detections/deprecated/web_fraud___account_harvesting.yml @@ -58,5 +58,4 @@ tags: - http_content_type - uri - cookie - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml index 2708e005f0..3498417248 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml @@ -53,5 +53,4 @@ tags: - _time - http_content_type - cookie - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml index 2d09283498..dab627999c 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml @@ -46,5 +46,4 @@ tags: - _time - http_content_type - uri - risk_score: 25 security_domain: threat diff --git a/detections/deprecated/windows_connhost_exe_started_forcefully.yml b/detections/deprecated/windows_connhost_exe_started_forcefully.yml index 97ce18f097..226bbeff56 100644 --- a/detections/deprecated/windows_connhost_exe_started_forcefully.yml +++ b/detections/deprecated/windows_connhost_exe_started_forcefully.yml @@ -49,5 +49,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml b/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml index 659b65928e..e553d40d9a 100644 --- a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml +++ b/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_name - Processes.process_name - Processes.process_path - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/detections/deprecated/windows_hosts_file_modification.yml index 5a02313c4d..f30249e4ac 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/detections/deprecated/windows_hosts_file_modification.yml @@ -41,5 +41,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml index 5e52b02525..fe4dc52356 100644 --- a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml @@ -45,7 +45,6 @@ tags: - DNS.src - DNS.query - _time - risk_score: 100 security_domain: network tests: - name: True Positive Test diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index be8b5a9c0c..b02f52a0ff 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -48,7 +48,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 792b6405c1..94003abe43 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -55,7 +55,6 @@ tags: - TargetProcessId - SourceImage - SourceProcessId - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index dd3ef42497..5dbdf9b99d 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/active_directory_lateral_movement_identified.yml b/detections/endpoint/active_directory_lateral_movement_identified.yml index dd1b694964..00b9772944 100644 --- a/detections/endpoint/active_directory_lateral_movement_identified.yml +++ b/detections/endpoint/active_directory_lateral_movement_identified.yml @@ -50,7 +50,6 @@ tags: - All_Risk.risk_object_type - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/active_directory_privilege_escalation_identified.yml b/detections/endpoint/active_directory_privilege_escalation_identified.yml index 8e6d7b4536..afd58a976e 100644 --- a/detections/endpoint/active_directory_privilege_escalation_identified.yml +++ b/detections/endpoint/active_directory_privilege_escalation_identified.yml @@ -50,7 +50,6 @@ tags: - All_Risk.risk_object_type - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 2fa39a396c..864534543d 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 5d4249b667..ca30097a11 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -50,7 +50,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 5098d28300..58eed027c5 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index abe5faa710..0c52ac376f 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -56,7 +56,6 @@ tags: - Message - ComputerName - User - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 711f6b3519..559553d68a 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index c26dfe87ae..fada60eed8 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -51,7 +51,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 3 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index c01adf1400..74076ebad1 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 3c21966aab..32a263ba25 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index b707e59cb7..3963f88d3d 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -80,7 +80,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 51a39c24cb..388550426c 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -80,7 +80,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 66ee79b73b..275a50a887 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -61,7 +61,6 @@ tags: - Processes.user - Processes.process_name - Processes.parent_process - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 6c596e2406..c29e32282c 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index a84ecb6ecc..460c91e134 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 294201841e..8c46a7d61b 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 1e5758ac7e..badff15dd0 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -51,7 +51,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 6d81f03a18..3dbcd272a5 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -61,7 +61,6 @@ tags: - Processes.process_guid - Processes.dest - Processes.process_name - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 9132d4be45..5b90fb73ea 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -54,7 +54,6 @@ tags: - Processes.parent_process - Processes.dest - Processes.user - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index e3704ecba0..9ecaecfb95 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 355cb2e0aa..be88f81f67 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 684066eb50..bbaf8f6457 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -76,7 +76,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 54a22b0389..b54ada68ab 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -75,7 +75,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index d9ac0a440e..2f597123ce 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 99e04f510e..14a797e983 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index faec0b2896..bb5eb618ff 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -77,7 +77,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 3335247e61..17acc1ea8e 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_key_name - Registry.registry_value_name - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 944e05e096..874fc0e64b 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -54,7 +54,6 @@ tags: - Processes.parent_process - Processes.dest - Processes.user - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 2e3fc9984c..b47073c1ce 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -59,7 +59,6 @@ tags: - parent_process_id - dest - user - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 4836eaefd4..46fe01113f 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.dest - Processes.user - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml index 5e1a946f1a..0aca93f1a5 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/endpoint/child_processes_of_spoolsv_exe.yml @@ -49,5 +49,4 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index dd1e86aac4..1d3a90c59e 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 6da68738bf..ed97027cad 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index f0e39741e1..7aecf74a05 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -49,7 +49,6 @@ tags: - process_name - OriginalFileName - process_path - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index f61bc4534d..a275807b64 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -72,7 +72,6 @@ tags: - Processes.user - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index b0904c99e5..5c532bc16a 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 798df38377..f6e4bdda44 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -77,7 +77,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index fb005bd54d..ef13990bc1 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -53,7 +53,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 76c185898b..8691858d35 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -64,7 +64,6 @@ tags: - process_name - process_path - process_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index d8c9971977..8e34f5c48e 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -47,7 +47,6 @@ tags: - Filesystem.dest - Filesystem.file_path - Filesystem.file_name - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 05fbddadbf..4dfe789f83 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -50,7 +50,6 @@ tags: - Filesystem.dest - Filesystem.file_path - Filesystem.file_name - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal.yml b/detections/endpoint/connectwise_screenconnect_path_traversal.yml index 59d5b9de0f..0aaeb71a08 100644 --- a/detections/endpoint/connectwise_screenconnect_path_traversal.yml +++ b/detections/endpoint/connectwise_screenconnect_path_traversal.yml @@ -49,7 +49,6 @@ tags: - Filesystem.file_name - Filesystem.file_path - Filesystem.dest - risk_score: 100 security_domain: endpoint cve: - CVE-2024-1708 diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml b/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml index 20524735b2..2baa10c2b0 100644 --- a/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml +++ b/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml @@ -52,7 +52,6 @@ tags: - EventCode - Computer - Caller_User_Name - risk_score: 100 security_domain: endpoint cve: - CVE-2024-1708 diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 6fd1516928..a5b0188a37 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 3dda6bc192..271e769eea 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index afa8171ec4..cb649b1932 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 7f37a0fc6b..61bb5cee24 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index d111a912d3..4cb61d2cda 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -55,7 +55,6 @@ tags: - StartAddress - EventCode - dest - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 93090b9533..5a88cb4be5 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -55,7 +55,6 @@ tags: - TargetImage - TargetProcessId - dest - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 7fbe0c79f0..e3f9ebce84 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -51,7 +51,6 @@ tags: - TargetFilename - dest - object_category - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 06b6424ff8..18e929919a 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 5f1f2dc252..1ec6cf4b8c 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 84c0161a95..ea99d9090a 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index b06e987f8d..d40c1579a6 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_admin_weak_password_policy.yml b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml index ba86802987..32496ab8f9 100644 --- a/detections/endpoint/crowdstrike_admin_weak_password_policy.yml +++ b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml index e79de23f10..bfd6b005af 100644 --- a/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml +++ b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_high_identity_risk_severity.yml b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml index 29dfcd8537..29941dc75e 100644 --- a/detections/endpoint/crowdstrike_high_identity_risk_severity.yml +++ b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml index 287e827d22..a4c5197bb5 100644 --- a/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml +++ b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_medium_severity_alert.yml b/detections/endpoint/crowdstrike_medium_severity_alert.yml index 4434865a56..be6d16d8f4 100644 --- a/detections/endpoint/crowdstrike_medium_severity_alert.yml +++ b/detections/endpoint/crowdstrike_medium_severity_alert.yml @@ -48,7 +48,6 @@ tags: - event.IncidentType - event.NumbersOfAlerts - event.SeverityName - risk_score: 49 security_domain: endpoint manual_test: This detection is marked manual test because the attack_data file and TA do not provide the event.EndpointIp and event.EndpointName fields. event.EndpointName is required to be present for the Risk Message Validation Integration Testing. This will be investigated and is a tracked issue. tests: diff --git a/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml index f0ae09358a..8aa5ce285f 100644 --- a/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml +++ b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml @@ -48,7 +48,6 @@ tags: - event.IncidentType - event.NumbersOfAlerts - event.SeverityName - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml index 6580ceb4ee..edad8343b3 100644 --- a/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml +++ b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml @@ -48,7 +48,6 @@ tags: - event.IncidentType - event.NumbersOfAlerts - event.SeverityName - risk_score: 49 security_domain: endpoint manual_test: This detection is marked manual test because the attack_data file and TA do not provide the event.EndpointIp and event.EndpointName fields. event.EndpointName is required to be present for the Risk Message Validation Integration Testing. This will be investigated and is a tracked issue. tests: diff --git a/detections/endpoint/crowdstrike_user_weak_password_policy.yml b/detections/endpoint/crowdstrike_user_weak_password_policy.yml index 88c8cb2623..b516b4e900 100644 --- a/detections/endpoint/crowdstrike_user_weak_password_policy.yml +++ b/detections/endpoint/crowdstrike_user_weak_password_policy.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/crowdstrike_user_with_duplicate_password.yml b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml index 1644e8c058..c92c0ca633 100644 --- a/detections/endpoint/crowdstrike_user_with_duplicate_password.yml +++ b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml @@ -47,7 +47,6 @@ tags: - accounts{}.domain - accounts{}.dn - accounts{}.samAccountName - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index fcd7b1b7d5..ac4e5462a1 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -45,7 +45,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 2ce7820ed7..8146b9822f 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 4769734851..8054eddf88 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -55,7 +55,6 @@ tags: - Computer - UserID - EventCode - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index a322d9c3e4..eebcbae375 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 12de67d851..f3961d5eea 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -76,7 +76,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 80df33c823..29db0573ce 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -76,7 +76,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index c3c6583c1f..7d9bda2ed8 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -62,7 +62,6 @@ tags: - file_name - process_id - file_create_time - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml index 51473d194c..0f9baea4c9 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -33,5 +33,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index c27585e4f2..fc102b794e 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -34,5 +34,4 @@ tags: required_fields: - _time - host - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index 0b9df268ba..964d56c04b 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -34,5 +34,4 @@ tags: required_fields: - _time - columns.cmdline - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/detect_certify_command_line_arguments.yml b/detections/endpoint/detect_certify_command_line_arguments.yml index 8865943e20..64220b2356 100644 --- a/detections/endpoint/detect_certify_command_line_arguments.yml +++ b/detections/endpoint/detect_certify_command_line_arguments.yml @@ -63,7 +63,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 786066e6f7..14d8e2a0ff 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -56,7 +56,6 @@ tags: - user - Computer - EventCode - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index 94f6b395b0..7f8d924daa 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -73,7 +73,6 @@ tags: - Filesystem.file_name - Filesystem.file_path - Filesystem.dest - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index f1bdb3499a..5294bad184 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -45,5 +45,4 @@ tags: - LogonType - TargetDomainName - user - risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index 9a66c3551e..1a829c484e 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -56,7 +56,6 @@ tags: - Computer - UserID - EventCode - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index b70a7f5076..601aac8d09 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -57,7 +57,6 @@ tags: - SourceProcessId - TargetImage - TargetProcessId - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml index 1f4623df42..4cf5d5afc8 100644 --- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml +++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml @@ -60,7 +60,6 @@ tags: - Alerts.id - Alerts.vendor - sourcetype - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index a06dd609a0..4c6eb4e19a 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -59,7 +59,6 @@ tags: - Computer - UserID - EventCode - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 485cb08fcc..0eac7f4949 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -53,7 +53,6 @@ tags: - nodename - All_Changes.result - All_Changes.dest - risk_score: 36 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 86ab796ff4..19a9060cfd 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -44,7 +44,6 @@ tags: - All_Changes.result - nodename - All_Changes.user - risk_score: 36 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 73d473bdd0..edd7730d92 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -65,7 +65,6 @@ tags: - Filesystem.file_name - Filesystem.file_hash - Filesystem.user - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index faf314f721..3a9a60c744 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 23bfff8d84..34db054882 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 75424eb7d7..11cf78f4e3 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index f677206918..8c13e77459 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 00bb8bbf27..9f5c855571 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -62,7 +62,6 @@ tags: - Computer - UserID - EventCode - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index e475b2d9d3..2feac8e8cb 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index f733763a8d..5138478349 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 41a2489a88..21766a635f 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 4aa7e2f628..b9445d82a3 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -55,7 +55,6 @@ tags: - member_id - dest - user - risk_score: 42 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 1ed6fce70a..aa40759f56 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -45,5 +45,4 @@ tags: - Processes.dest - Processes.parent_process_name - Processes.user - risk_score: 25 security_domain: network diff --git a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml index 1271d4052c..24186d8a23 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml @@ -59,7 +59,6 @@ tags: - Authentication.action - Authentication.src - Authentication.user - risk_score: 60 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml index a191014ffd..a6ee17ce14 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml @@ -55,7 +55,6 @@ tags: - Authentication.action - Authentication.src - Authentication.user - risk_score: 60 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 188dd6f56f..6e0288c31e 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 2c66b755db..cc173f858b 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index ac2d1bf5e2..f7f51c1d34 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 4d74498cd7..2411ab3917 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -79,7 +79,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 8c752373bf..87aaa20848 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -47,7 +47,6 @@ tags: - Processes.dest - Processes.user - Processes.process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index d8fdc96b61..d99186e789 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -68,7 +68,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.original_file_name - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index ea53a967e1..ec73567fe0 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -71,7 +71,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index b498470a10..563804881a 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -63,7 +63,6 @@ tags: - src_ip - dest_host - dest_ip - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 359cc546b5..f6a0a48cd4 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index aebfcadc80..9138e4dd4e 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -68,7 +68,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 793df12d63..12e80f65f5 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -61,7 +61,6 @@ tags: - user - src_ip - dest_host - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 5fdb62fa14..b070d131ba 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 07251b0829..45e6d60eda 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -75,7 +75,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index cc60690ec0..1916652e71 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -59,7 +59,6 @@ tags: - Filesystem.dest - Filesystem.user - Filesystem.file_name - risk_score: 25 security_domain: endpoint manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 6287e78971..ed4e64bb9a 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -61,7 +61,6 @@ tags: - parent_process_name - process_name - process - risk_score: 25 security_domain: endpoint manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 1f729d3002..1d58290f2b 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -64,7 +64,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 8373d98313..3425cdb52f 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index b57326a6f1..7829f7a065 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 7e35894d6e..ab45ec309b 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 2fa0b592b9..6439469686 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index b933a54548..2d97e5c283 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -58,7 +58,6 @@ tags: - Filesystem.file_name - Filesystem.file_path - Filesystem.process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml index e2a59626eb..a41da5148c 100644 --- a/detections/endpoint/detect_rtlo_in_process.yml +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_name - Processes.parent_process - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 3882a3c6e2..3b8c836224 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index d9eed1f56a..0e584f9b2d 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 5316cd3f4f..9854ee4c48 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index d1fc946319..9805fc1063 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index ac7865950b..2d21806255 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -63,7 +63,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index e900ca34d2..987df7cd69 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -63,7 +63,6 @@ tags: - file_name - process_id - file_create_time - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index bb91384d98..f71b89309e 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index c8b65b0af1..504cda7bce 100644 --- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -47,5 +47,4 @@ tags: - Processes.parent_process - Processes.user - Processes.dest - risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 438f5f32d2..47f41f9257 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -54,7 +54,6 @@ tags: - Processes.parent_process - Processes.user - Processes.dest - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index f192d9ce05..83df6c307e 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_name - Processes.process - Processes.process_name - risk_score: 80 security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 6dcd57635d..e331e48144 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -49,7 +49,6 @@ tags: - Destination - dest - User - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index 82c62dec44..2223b8112e 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -38,5 +38,4 @@ tags: - Processes.parent_process - Processes.process_name - Processes.user - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 0341c5ae1f..4d8395775e 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 1d3086be8c..a0422e0459 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 4f96e6bb1d..65db1fda70 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -66,7 +66,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 4fe332730f..13e766ae45 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 2470388229..8651b539a0 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 761cc8ba4a..68c0611165 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index a1aabc7f9a..aa1be9b1be 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -55,7 +55,6 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index bfea40724a..6adc7a324e 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 0fe4c203ca..2efdd92e2c 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -50,7 +50,6 @@ tags: - Processes.process_name - Processes.parent_process_name - Processes.dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 33ece190e0..a516c5336c 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index c9298d6d3b..73bd99fd10 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 98932c8427..6ce2407aef 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 6f2b6d4d83..cbc15ba9a3 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guidr - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index fd74332131..7e762e68b1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index f80a923281..80f376fb5a 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index 22db024347..f7900d1ca6 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -52,7 +52,6 @@ tags: - Computer - UserID - EventCode - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index f6c7e6a1b0..36bfdb72c3 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -50,7 +50,6 @@ tags: - Computer - UserID - EventCode - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index c2fbe69a2b..1a21719e80 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 641b9b611a..bb73193619 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test (XML) diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 51c7effed0..f896babfef 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index e2d98f9e94..616afcca36 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index b1acc1f67b..454eedd958 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index e7b75edae3..362174ef2d 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 917c9bddea..c385281411 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index eebf924779..229f445a26 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_key_name - Registry.user - Registry.action - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 6cc378c606..cc26849c35 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 4b27343d5a..8a09a151df 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml index 2743ee1d13..9434d90a0d 100644 --- a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml +++ b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.dest - Registry.user - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 6b10290013..0a707ce593 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -54,7 +54,6 @@ tags: - parent_process_name - dest_port - process_path - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 36ff272eff..ed3ee5b384 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index c9055eb099..11038804bb 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -53,7 +53,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index aaff8ce6a9..5b451eb842 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -64,7 +64,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 813ed1392b..e89d599e7d 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -61,7 +61,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 90b0bec806..c4637f0dd3 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index c134e91ba6..81f0623221 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -45,7 +45,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index a8fa23c479..73f0bba637 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -48,7 +48,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 18 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 6ae8ccb612..10d3fd6d03 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 417c285f12..2910eb54aa 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -50,7 +50,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 3c67ed5b0c..dd2ffe226a 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 32643a7bbd..8396228a8c 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -50,7 +50,6 @@ tags: - process_id - TargetFilename - Hash - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index d6d6952154..62db838871 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -38,7 +38,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index ae48ed6bbd..941f0c866d 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -67,7 +67,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 50a6933161..6833bd0d77 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -80,7 +80,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index ea129aebfc..f398d92b40 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -69,7 +69,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index dc403a51c8..b1dff481dc 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index e25c937eb4..9e48be95c2 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -41,7 +41,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index c66d1f3ef3..789668b6ce 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 7de728a29d..4f5d14d309 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -54,7 +54,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 4c84a247ea..ce7c5b8ceb 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index acd77891de..8fde0c8baf 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -57,7 +57,6 @@ tags: - Logon_ID - Security_ID - Message - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index 3d2de049a2..39ea944bbb 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 46e1f8d46e..3ccfaf19c3 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -60,7 +60,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 0585adffec..18b6da977d 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -71,7 +71,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index 8e85b55c3b..e176914ed8 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 49407cbc27..8042a4f79c 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -64,7 +64,6 @@ tags: - dest - user - parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 313f24c289..af6ec17699 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml index 9b49578493..2a4038a251 100644 --- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml +++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml @@ -47,7 +47,6 @@ tags: - Processes.process - Processes.dest - Processes.user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index b4c84b73a2..d8ee8451c2 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -62,7 +62,6 @@ tags: - process_name - process_path - process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 1c819752ad..3038d040a7 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 6b5b38552a..a514656517 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -48,7 +48,6 @@ tags: - Processes.process_name - Processes.dest - Processes.user - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 90dcb51e91..ebfb0aa1a6 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index c68c383ee9..d7c4b6a360 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 9d5f2390f0..c1b6c5b89a 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 6f1b98e42a..d5ce9b9403 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -52,7 +52,6 @@ tags: - dest - process_name - EventCode - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 331e4ae543..8bd4c087b9 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -49,7 +49,6 @@ tags: - EventCode - process_name - process - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index d84d915514..2e853202e6 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -61,7 +61,6 @@ tags: - Processes.user - Processes.process - Processes.process_id - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml index 6b6c056881..a3921cdee3 100644 --- a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml +++ b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml @@ -41,5 +41,4 @@ tags: - cs_uri_query - cs_method - c_uri - risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml index 716e5761d5..36d1a825aa 100644 --- a/detections/endpoint/exchange_powershell_module_usage.yml +++ b/detections/endpoint/exchange_powershell_module_usage.yml @@ -60,7 +60,6 @@ tags: - Computer - UserID - EventCode - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index b56696e19e..6e458f7072 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -63,7 +63,6 @@ tags: - user - src_port - Source_Address - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 4e5dbe8f06..18a09337e3 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -87,7 +87,6 @@ tags: - Filesystem.process_id - Filesystem.file_name - Filesystem.user - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 776d31e917..0760af5d9d 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -60,7 +60,6 @@ tags: - Processes.process_id - Processes.dest - Processes.user - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index fa5d5a9608..8acf2ef0b4 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -60,7 +60,6 @@ tags: - Processes.dest - Processes.user - Processes.parent_process - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index ae858df02b..9c685c2c12 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 65c47fde68..cfbae33c33 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -53,7 +53,6 @@ tags: - Filesystem.dest - Filesystem.file_path - Filesystem.file_name - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 44ca8b97b2..94335bb71f 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index eb7ecf75e3..697e7cbf6f 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -49,5 +49,4 @@ tags: - Processes.parent_process_name - Processes.process_id - Processes.dest - risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml index 0fd17fe892..f74441babe 100644 --- a/detections/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/endpoint/first_time_seen_running_windows_service.yml @@ -38,5 +38,4 @@ tags: - EventCode - Message - dest - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index dbaabe7626..5e7442707e 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -67,7 +67,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index d22e607e99..6f7b85d209 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -52,7 +52,6 @@ tags: - Processes.dest - Processes.process - Processes.parent_process - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index ef2d36939f..cb1e41f959 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -53,7 +53,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 27663ba886..5aecc4b0cc 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -43,7 +43,6 @@ tags: - Message - ComputerName - User - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 7e1e41a272..5a32cabecb 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -55,7 +55,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 71278afb8e..d84e7b8c6b 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -45,7 +45,6 @@ tags: - Message - ComputerName - User - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index b2395ae5cb..f835bc10bb 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -63,7 +63,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 21099ac055..509d2000f0 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -54,7 +54,6 @@ tags: - Computer - UserID - EventCode - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 51bc51afba..9d5f094728 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -62,7 +62,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 040b3b3a8f..d52fd5eafd 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -53,7 +53,6 @@ tags: - Computer - UserID - EventCode - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 104e0fc7d8..d32618bb41 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index 8bdd67f052..65fe1fb863 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -55,7 +55,6 @@ tags: - Computer - UserID - EventCode - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 7e134634f4..33c90a5748 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -62,7 +62,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 15f8ca9271..a67261c3da 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -52,7 +52,6 @@ tags: - Message - ComputerName - User - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 4054f61b0a..f00a6300f5 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index bd3b8b0589..78f28a2dd5 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -54,7 +54,6 @@ tags: - Opcode - Computer - UserID - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index 74644e095f..cf16d99be8 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 39f402b636..e66ab0b2fb 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -47,7 +47,6 @@ tags: - Message - ComputerName - User - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index 06df5ece36..821f7a82ed 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -45,7 +45,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 0e8f0f9739..b67c0bd681 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -41,7 +41,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 8ce2215d7b..93142a8fd9 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -47,7 +47,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 64c37d39b9..d4969f1688 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -39,7 +39,6 @@ tags: - Message - Computer - UserID - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 2544767d59..085bb563ae 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index acd2cab9a6..4dfaa09866 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -40,7 +40,6 @@ tags: - ComputerName - User - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index a839689dc7..ca2c205684 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -54,7 +54,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml index 23c6796ab5..36d47f53f0 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml @@ -48,7 +48,6 @@ tags: - Computer - UserID - EventCode - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 2e7ce8733b..44a57f4342 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index e9f9ade50f..117d22c040 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -48,7 +48,6 @@ tags: - Computer - UserID - EventCode - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 21b723baaa..04ee575c9f 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 5591ec7a74..4d4207e0bb 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -49,7 +49,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 6665f0ab23..be90ac677a 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -36,7 +36,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 6bde9c3ad2..97dd53b765 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -41,7 +41,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index cb7faa1a85..edde0e813e 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml index 3112e995bc..ddcaa0b775 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml @@ -39,7 +39,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index a07fe4a02f..527f9cd358 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -54,7 +54,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index ccda84eb9d..4334db23f1 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -48,7 +48,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index 6ec59747aa..58c8df9be5 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 22c9d6092f..5606861024 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -49,7 +49,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 47f97e6a25..72233a025f 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -61,7 +61,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 124ff99680..8f3f909ffd 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -53,7 +53,6 @@ tags: - Computer - UserID - EventCode - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 35378a0a38..d26e2547a4 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -37,7 +37,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index b8a6c9925d..cb410b387c 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -42,7 +42,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 6fbabbc43a..96948b0901 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -63,7 +63,6 @@ tags: - parent_process_name - dest_port - process_path - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml index be661ffec4..49f0ee4a62 100644 --- a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml +++ b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 56 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/headless_browser_usage.yml b/detections/endpoint/headless_browser_usage.yml index 9a6324c014..51cdec466a 100644 --- a/detections/endpoint/headless_browser_usage.yml +++ b/detections/endpoint/headless_browser_usage.yml @@ -38,7 +38,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 75f768007b..b9d61b70ed 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -61,7 +61,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index d2649b7a64..7c86fa4949 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process - Processes.user - Processes.dest - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 40456bc74e..b0c982d0e4 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -55,7 +55,6 @@ tags: - user - src_port - Source_Address - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 6835d76660..be7b05f755 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -55,7 +55,6 @@ tags: - dest - _time - ProcessID - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml index 7e2c649411..787657234f 100644 --- a/detections/endpoint/hunting_3cxdesktopapp_software.yml +++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 461676c36a..5460c73791 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -56,7 +56,6 @@ tags: - Processes.user - Processes.process_id - Processes.process - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 9445ecf5d7..bed1381f5d 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -55,7 +55,6 @@ tags: - Processes.user - Processes.process_id - Processes.process - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 1d08d86553..2772e5a379 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -45,7 +45,6 @@ tags: - process_id - process_name - dest - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 31a62c862f..6e1e737ead 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -75,7 +75,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml index 97a9db60de..2e5a329ad3 100644 --- a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml @@ -70,7 +70,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index 247dc4f274..483ea9f354 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -71,7 +71,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 99735271b1..38e6cef5a9 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -48,7 +48,6 @@ tags: - Message - ComputerName - User - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 283304bac3..41861c3b66 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -70,7 +70,6 @@ tags: - Filesystem.file_path - Filesystem.process_guid - Filesystem.user - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 26b541ed1f..c7273b8666 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -58,7 +58,6 @@ tags: - Processes.process - Processes.dest - Processes.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 95fbfdeba3..48fcd5daf8 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -64,7 +64,6 @@ tags: - Computer - service - service_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index ce485d7acb..50ee6ab739 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -50,7 +50,6 @@ tags: - Account_Name - Security_ID - MSADChangedAttributes - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml index 79786485f4..fd3f089839 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -49,7 +49,6 @@ tags: - ScriptBlockText - Computer - user_id - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml index daf6a40448..5afbdc7094 100644 --- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml @@ -54,7 +54,6 @@ tags: - dest - service - service_id - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml index 63dcabc878..b28dca4f42 100644 --- a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml @@ -47,7 +47,6 @@ tags: - EventCode - TicketEncryptionType - ServiceName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/kerberos_user_enumeration.yml b/detections/endpoint/kerberos_user_enumeration.yml index d8b386f4a2..60fd4ebbf4 100644 --- a/detections/endpoint/kerberos_user_enumeration.yml +++ b/detections/endpoint/kerberos_user_enumeration.yml @@ -49,7 +49,6 @@ tags: - Result_Code - Account_Name - Client_Address - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 6db1615d1c..1e579305d4 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -55,7 +55,6 @@ tags: - Message - dest - Type - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index ead82abba3..c6b1744c59 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -50,7 +50,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index c8e8d9de04..5b14ce0cf2 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -52,7 +52,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 33840facfb..83139fbcba 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -42,7 +42,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml index 336fefcd17..a635b9c165 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml @@ -48,7 +48,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index acdb068472..cdd432e4ca 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index 47211d30dd..cfb0c5112c 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 5519e8672e..831a6c533d 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -51,7 +51,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 90fd6f0483..d3309ddfab 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 3fd4de81ce..a80987dec3 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -46,7 +46,6 @@ tags: required_fields: - _time - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 19e183e33c..34634bf18d 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -52,7 +52,6 @@ tags: - res - UID - type - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index e142bdd4cf..f6ca1c20ed 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -54,7 +54,6 @@ tags: - UID - ppid - pid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index e90f3fec26..6e319b0c91 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -50,7 +50,6 @@ tags: - UID - comm - exe - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 907eb58b78..1773a63279 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 3c8eba210c..6c16348207 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -48,7 +48,6 @@ tags: required_fields: - _time - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 8970534501..5d3f2d8c5f 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -46,7 +46,6 @@ tags: - _time - argc - process_exec - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index e67774b5c1..6a5a2ebc77 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -47,7 +47,6 @@ tags: - _time - argc - process_exec - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 820564df65..8da72aeac3 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -47,7 +47,6 @@ tags: - _time - argc - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 9684772de3..3801c130b7 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -51,7 +51,6 @@ tags: - UID - ppid - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index da49b339d6..693417262f 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 3a60721624..ce12c18355 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -46,7 +46,6 @@ tags: required_fields: - _time - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 84510717a5..f87a70b292 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -51,7 +51,6 @@ tags: - UID - comm - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 50a5fde6ec..1bc402f554 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -49,7 +49,6 @@ tags: - name - nametype - OGID - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 934aa7c17d..d2d53daf24 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -52,7 +52,6 @@ tags: - UID - ppid - pid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 07d145ef1b..c2f019bc93 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -53,7 +53,6 @@ tags: - UID - ppid - pid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 408246dd45..ceee8b1cfe 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 3e4d9f7bc6..3855ba25dc 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -47,7 +47,6 @@ tags: required_fields: - _time - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index fbbd639de3..6238e2149b 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index d4897a6360..07630cf985 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -49,7 +49,6 @@ tags: - _time - argc - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 9adac7eebd..2f996d9e67 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -49,7 +49,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index 713ccc03a2..a96015abad 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -49,7 +49,6 @@ tags: - _time - argc - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 03daf2d62b..58362d5ec3 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -49,7 +49,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index b6b196b857..8b8dbde598 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -46,7 +46,6 @@ tags: - _time - argc - process_exec - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index f4b313e1ab..00f45638c4 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index b79acba0b0..71b2f5029f 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -54,7 +54,6 @@ tags: - UID - ppid - pid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 9751b854ce..e7f8b99efc 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -54,7 +54,6 @@ tags: - UID - ppid - pid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index e5629b19f3..4e99faa1c4 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -50,7 +50,6 @@ tags: - UID - ppid - pid - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 6c4145b1ef..22ad724680 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -52,7 +52,6 @@ tags: - UID - ppid - pid - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 37a7748495..7f096482a7 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -47,7 +47,6 @@ tags: required_fields: - _time - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index f8218b50a6..515427d49f 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -50,7 +50,6 @@ tags: - UID - comm - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 5b1bb8f93a..5789f3ddda 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -50,7 +50,6 @@ tags: - name - nametype - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 7a393d7dc3..5cb09880a6 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -47,7 +47,6 @@ tags: required_fields: - _time - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 19ab4be8f0..68a28947c6 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -49,7 +49,6 @@ tags: - name - nametype - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 7d10dddeb9..28f6c34f22 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -43,7 +43,6 @@ tags: - name - nametype - OGID - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index b0b87780b3..461bd7013c 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -47,7 +47,6 @@ tags: - _time - argc - process_exec - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index ed9d9ff948..b52f196f87 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -49,7 +49,6 @@ tags: - name - nametype - OGID - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 87bbb2e1ec..91f497caa8 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -51,7 +51,6 @@ tags: required_fields: - _time - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 127d703220..5c6ffb80ca 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -47,7 +47,6 @@ tags: required_fields: - _time - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index c8ade3e08d..ca65058d29 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -47,7 +47,6 @@ tags: required_fields: - _time - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index dab576f585..d9c3d74170 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -47,7 +47,6 @@ tags: - _time - argc - process_exec - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 21220aebad..970b56e7eb 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -49,7 +49,6 @@ tags: required_fields: - _time - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 745186a07a..2955d30e79 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -51,7 +51,6 @@ tags: - UID - comm - exe - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index eb9bd249f1..e4d95c5d66 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -46,7 +46,6 @@ tags: required_fields: - _time - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index fe72f91575..842b4faab1 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -50,7 +50,6 @@ tags: - UID - comm - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 2aa7efb626..27c4fb7194 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -51,7 +51,6 @@ tags: - UID - ppid - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 2d75516cb6..6b9894d7e0 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -50,7 +50,6 @@ tags: - name - nametype - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index f34589900d..55122ceed8 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index cabae614c3..44c7e8b0b2 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -48,7 +48,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index d2bf0d74d7..8aa1e51e02 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -52,7 +52,6 @@ tags: - UID - ppid - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 818dc533a5..483c2e40ea 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index 4d836fa5bb..3cf436e12c 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 80ebe84edf..daf174d681 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 54ec5b893a..da7c4aff2c 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml index c9adc9f578..cb16851c37 100644 --- a/detections/endpoint/linux_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -53,7 +53,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 8e65848fec..e6bc0a23bd 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index a7a5dcea78..35ab66446a 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -46,7 +46,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 5b5b73996a..324eecd88f 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 41562aee25..ea619fe1ac 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 0104e41822..f51bf6debf 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 8e0e4a459f..ea39f60e95 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index de61188fb8..6b611a04c7 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -55,7 +55,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index bbec4a58d0..0dcb0e0b86 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index 98ca08285b..419325e1af 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml index b4ccc41d19..826db2c09b 100644 --- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 372beef4cd..5286f06f19 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -56,7 +56,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 964c68d38d..d3183aa1e6 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -56,7 +56,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 675a8a64f5..671a92507d 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -59,7 +59,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 27cfec49ed..0d1de08085 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -55,7 +55,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml index 6493dfe15e..172b2377ba 100644 --- a/detections/endpoint/linux_disable_services.yml +++ b/detections/endpoint/linux_disable_services.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index 69ebf10e4d..7dc1586a8e 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -50,7 +50,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 9fbd372be8..8b10e6efe4 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index ab6b0d3dc4..192e1cec26 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index 7d46839e16..311457d9c6 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -44,7 +44,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index c44f6370a0..df1b30eaa8 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml index 14976063c1..00490204b7 100644 --- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -52,7 +52,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index f439334a11..5d2b61fc81 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -49,7 +49,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index 9c75f75660..bf0e309b4b 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -50,7 +50,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index 3f4af49715..174201b857 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index 48a4050581..ea3623c93c 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index 89e7b80e14..604130d456 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 18efeb3b06..5e19c5543e 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_hardware_addition_swapoff.yml b/detections/endpoint/linux_hardware_addition_swapoff.yml index 645b98b69f..99b8b5a555 100644 --- a/detections/endpoint/linux_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_hardware_addition_swapoff.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index 077434def8..1d09187e21 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -53,7 +53,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index e3b8105ac3..7662ff0967 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -51,7 +51,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_impair_defenses_process_kill.yml b/detections/endpoint/linux_impair_defenses_process_kill.yml index a4cdc259aa..51ae8a2809 100644 --- a/detections/endpoint/linux_impair_defenses_process_kill.yml +++ b/detections/endpoint/linux_impair_defenses_process_kill.yml @@ -47,7 +47,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_indicator_removal_clear_cache.yml b/detections/endpoint/linux_indicator_removal_clear_cache.yml index 3d4e6fe939..093941f873 100644 --- a/detections/endpoint/linux_indicator_removal_clear_cache.yml +++ b/detections/endpoint/linux_indicator_removal_clear_cache.yml @@ -55,7 +55,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml index e7bfe7bcba..5562eb50fb 100644 --- a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml +++ b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml @@ -56,7 +56,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index e4324b1fc0..b274af9a38 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index d3efb99447..65b0de3ca1 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index e5bd62232d..206223d53f 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml index 5beb8ec250..68d160f91d 100644 --- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index a4834c41fc..a00efb0ab1 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index f07fe010ea..162440c5cb 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 6c3da70583..d8350a5370 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index f113377782..50424ff968 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -47,7 +47,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_path - Processes.process_path - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index 94b18226a5..e812155c30 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 0cc85e74cb..2c9aca8a4f 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml index 430384539f..53a591e0e5 100644 --- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 96a6304aff..45e8fe8e59 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 95d100074f..ac89093391 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 3909f1243b..145fe846bf 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index d92df168f8..9c47141db8 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 20546d4dab..70768500e6 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml index 50eae30781..a8b068a8e7 100644 --- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml +++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml @@ -47,7 +47,6 @@ tags: - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - source - risk_score: 56 security_domain: audit tests: - name: True Positive Test diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index ad00906f2f..141cf4da58 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index c28dc03619..7db94dac56 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml index 9eb0ae41d0..5ea328f5ff 100644 --- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml @@ -53,7 +53,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index eb3959d368..fc717a61a8 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index 4136db1b8b..fc405dbcd2 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index a1a9856643..221556bea8 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -53,7 +53,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 02cfba25df..d687f3f738 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index bd27ec0764..e8e102e9e1 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -46,7 +46,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index c92f717c39..16d3b7c5ee 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -44,7 +44,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 6 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml index 699db7117d..ecab7de8b5 100644 --- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml +++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml @@ -51,7 +51,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index f1a87bdcf5..fb4ca3130b 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index d6bf1cd352..71d5efdd68 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index 6990a1c32b..c30e68ee4a 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 0a6abe1396..c941c7c070 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index 4532ef9607..27a6521dca 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 46e38fcbbc..b55bc3e5c9 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -55,7 +55,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 90236f3737..00d48984c3 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -56,7 +56,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index a49bd4387a..67b0ca118e 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index e90b59d135..c7ebd6b6d2 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index 63a9d339f9..3eccd73c0a 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml index 043bdd0526..9d8a8a9326 100644 --- a/detections/endpoint/linux_shred_overwrite_command.yml +++ b/detections/endpoint/linux_shred_overwrite_command.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 48c8281336..cc184871b0 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index 1852f70c3e..f8380dae08 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 4d6dadc793..d1f542dd1c 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml index 4ecd70c6ba..2002fcc817 100644 --- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -44,7 +44,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml index 2fb07d40eb..0ca18e459d 100644 --- a/detections/endpoint/linux_stop_services.yml +++ b/detections/endpoint/linux_stop_services.yml @@ -52,7 +52,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index 17326375d8..ade3917bc0 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -42,7 +42,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 44357a9747..7ff50ff50a 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -49,7 +49,6 @@ tags: - Filesystem.file_name - Filesystem.process_guid - Filesystem.file_path - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 9f00dcba56..845950eda9 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index 9788d771c7..d7c91c996f 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -54,7 +54,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml index 432f98c3d1..4f9b5aedaa 100644 --- a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml +++ b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml @@ -55,7 +55,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml index 20fb83eac5..a1595707ad 100644 --- a/detections/endpoint/linux_visudo_utility_execution.yml +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/living_off_the_land_detection.yml b/detections/endpoint/living_off_the_land_detection.yml index 35658e70a0..7fa028346d 100644 --- a/detections/endpoint/living_off_the_land_detection.yml +++ b/detections/endpoint/living_off_the_land_detection.yml @@ -50,7 +50,6 @@ tags: - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - source - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 7891f30eab..9a6e0985ed 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -58,7 +58,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index c9a24daa9a..9cbf3e3a06 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -37,7 +37,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index d849689ed8..f2033f60c7 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -36,7 +36,6 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml index 3153b8f737..baa1ce6dc0 100644 --- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml +++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml @@ -51,7 +51,6 @@ tags: - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - source - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 9b9dd4313c..3573385267 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_key_name - Registry.registry_value_name - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index 945c47dd7f..35b61c971d 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -64,7 +64,6 @@ tags: - All_Traffic.dest - All_Traffic.dest_ip - All_Traffic.process_id - risk_score: 25 security_domain: network tests: - name: True Positive Test diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/endpoint/macos___re_opened_applications.yml index c4ddf24cba..72709aa6a4 100644 --- a/detections/endpoint/macos___re_opened_applications.yml +++ b/detections/endpoint/macos___re_opened_applications.yml @@ -40,5 +40,4 @@ tags: - Processes.process_name - Processes.parent_process_name - Processes.dest - risk_score: 25 security_domain: threat diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml index edd386462c..99b09a72b9 100644 --- a/detections/endpoint/macos_lolbin.yml +++ b/detections/endpoint/macos_lolbin.yml @@ -53,7 +53,6 @@ tags: - columns.signing_id - columns.username - host - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index e06373a131..92e02083d5 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -53,7 +53,6 @@ tags: - columns.signing_id - columns.username - host - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 45bf77c8e1..8863fe1faa 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -52,7 +52,6 @@ tags: - Computer - UserID - EventCode - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 6deaff154a..d0435321f6 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -57,7 +57,6 @@ tags: - registry_key_name - registry_value_name - user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index fcee338d5e..ae58f4d595 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -57,7 +57,6 @@ tags: - Service_Start_Type - Service_Account - user - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 41518c5284..4c14fcaa66 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 4bf7f6a5b3..5878f13b6a 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index f5bcfd7458..735ce8cb41 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 6f353879fa..64e411d509 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -65,7 +65,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index 5fc4f7cb38..7dc2c2400f 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 78e25a989f..2dcc46e787 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -58,7 +58,6 @@ tags: - process_guid - process_id - user_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index abcc1f260d..6684223eb5 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -50,7 +50,6 @@ tags: - Processes.user - Processes.process - Processes.process_id - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 4d2dba7079..9bc313409e 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -51,7 +51,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/moveit_certificate_store_access_failure.yml b/detections/endpoint/moveit_certificate_store_access_failure.yml index 92d9a4dd6b..9a4f3fcd06 100644 --- a/detections/endpoint/moveit_certificate_store_access_failure.yml +++ b/detections/endpoint/moveit_certificate_store_access_failure.yml @@ -33,7 +33,6 @@ tags: required_fields: - source - _raw - risk_score: 9 security_domain: endpoint cve: - CVE-2024-5806 diff --git a/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml b/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml index d4e208c985..f706ddbc72 100644 --- a/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml +++ b/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml @@ -33,7 +33,6 @@ tags: required_fields: - source - _raw - risk_score: 9 security_domain: endpoint cve: - CVE-2024-5806 diff --git a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml index f69f8a4952..96a0675045 100644 --- a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml +++ b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -56,5 +56,4 @@ tags: - Processes.process_id - Processes.process_name - Processes.process_guid - risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 4857190da7..3835ea9d2b 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -51,7 +51,6 @@ tags: - ProcessGuid - dest - ImageLoaded - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 0aa5fcf4a0..ae8ecc68e7 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -51,7 +51,6 @@ tags: - ProcessGuid - dest - ImageLoaded - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 2fe2f15916..93068ea471 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -55,7 +55,6 @@ tags: - Processes.process_name - Processes.original_file_name - Processes.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 9962d69728..7d35094bfe 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index adaaba6fd6..26de9c153b 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -59,7 +59,6 @@ tags: - OriginalFileName - process_id - dest - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index b9f668e0df..3ef4cbe00e 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -50,7 +50,6 @@ tags: - dest - EventCode - ProcessId - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index de95b77b99..69bc783757 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 7f1c8b993d..a2a60dba3d 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -48,7 +48,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 848beeb1af..393346be15 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/endpoint/network_connection_discovery_with_net.yml index 3de8e710bf..c0093ee428 100644 --- a/detections/endpoint/network_connection_discovery_with_net.yml +++ b/detections/endpoint/network_connection_discovery_with_net.yml @@ -48,7 +48,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/network_connection_discovery_with_netstat.yml b/detections/endpoint/network_connection_discovery_with_netstat.yml index 41e5e1a4cd..df29a2863f 100644 --- a/detections/endpoint/network_connection_discovery_with_netstat.yml +++ b/detections/endpoint/network_connection_discovery_with_netstat.yml @@ -53,7 +53,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index f603950937..d469e17364 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -48,7 +48,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 36665cccf4..3f741495c5 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -33,7 +33,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - ShareName diff --git a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml index feb85ebb05..1af860cbc5 100644 --- a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml +++ b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 10 required_fields: - All_Traffic.src_ip - All_Traffic.dest_ip diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index f0af8c38bf..b062a51072 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index fce99e05b2..c3e6e6f3a1 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 637f868354..75d30b8d73 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -61,7 +61,6 @@ tags: - EventCode - dest - user - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 2a16ca2ff8..4227c6a396 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -62,7 +62,6 @@ tags: - EventCode - dest - user - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml index 3abe3a0f92..778ec90970 100644 --- a/detections/endpoint/notepad_with_no_command_line_arguments.yml +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -64,7 +64,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 207cbf7944..06d7fab085 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 3c7a064517..9789275799 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -59,7 +59,6 @@ tags: - process_guid - dest - user_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 4243d324ac..870654d7cd 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 57bbdf3cec..2a3c81fb38 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 9c3c447078..0af0cf1456 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -53,7 +53,6 @@ tags: - ProcessId - ProcessGuid - _time - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 7cbe39d7e0..4459497eaa 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -65,7 +65,6 @@ tags: - ProcessId - ProcessGuid - _time - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 1eef641d0b..b49087e41c 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index f095e1101c..31b03dbe0b 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index d0293491cf..cab6d7536a 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index d10f140875..8f57235f1f 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 54a83c801b..73a87a8faa 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -64,7 +64,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index b8ecf8fea7..de7bdf5c03 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 1118bc6395..3287b9aed5 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index cd08748142..e773b755a3 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 1c7175a870..47e89a9d62 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -63,7 +63,6 @@ tags: - file_create_time - file_name - file_path - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index f3f6ada98e..78372841bc 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 244d9c25b3..7fd375e0aa 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -55,7 +55,6 @@ tags: - All_Traffic.process_id - All_Traffic.dest - All_Traffic.dest_port - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 597f133ad0..9ea9fab3e1 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -53,7 +53,6 @@ tags: - Filesystem.file_path - Filesystem.file_name - Filesystem.dest - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml b/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml index 00a84a51cf..bb0b1d1cf6 100644 --- a/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml +++ b/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml @@ -38,7 +38,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - uri_match - ip_match diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index d7e113d61e..b6fdf12b12 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -51,7 +51,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 9f41a164a9..0ca23aebdf 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -57,7 +57,6 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/petitpotam_network_share_access_request.yml b/detections/endpoint/petitpotam_network_share_access_request.yml index 3524d98894..720589755c 100644 --- a/detections/endpoint/petitpotam_network_share_access_request.yml +++ b/detections/endpoint/petitpotam_network_share_access_request.yml @@ -52,7 +52,6 @@ tags: - src - AccessMask - AccessReason - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index dbdc5d10a2..f7cb68f857 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -51,7 +51,6 @@ tags: - Client_Address - action - Message - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 27ccbce748..63df2867de 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 0857e14423..c088333560 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index b52b6e0dbb..b3193ffda1 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index 737b295ebe..acb6f8c0aa 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -46,7 +46,6 @@ tags: - Authentication.src - Authentication.dest - sourcetype - risk_score: 21 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 8a75deedf3..f51522b023 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process - Processes.user - Processes.dest - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index f85fb5d5fb..f511a92898 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -59,7 +59,6 @@ tags: - Computer - UserID - EventCode - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index 228b80e665..c857c39737 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -61,7 +61,6 @@ tags: - Processes.user - Processes.parent_process_name - Processes.dest - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 6b2d83fe19..c9506fba44 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -52,7 +52,6 @@ tags: - Computer - UserID - EventCode - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 87d87ec658..d3ba30bb11 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -56,7 +56,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index d926d66286..60ccc5b10b 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -59,7 +59,6 @@ tags: - Computer - UserID - EventCode - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index addfdecfe0..171968304c 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -46,7 +46,6 @@ tags: - EventCode - ScriptBlockText - Computer - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 68bab1f2bd..680d32a4bf 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -51,7 +51,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 3b1df0d04c..127c6ba3a1 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -51,7 +51,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index e3e7d2a05a..e6854ca451 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -55,7 +55,6 @@ tags: - Computer - UserID - EventCode - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 4b7ab4b0b3..1d6d6272dc 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -58,7 +58,6 @@ tags: - Computer - UserID - EventCode - risk_score: 56 security_domain: endpoint asset_type: Endpoint tests: diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index c6c96be263..b1b1cb0437 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index bc59cd4802..d6ad50c9f8 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -48,7 +48,6 @@ tags: - Computer - UserID - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 953bf9262b..b6e413bc66 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -46,7 +46,6 @@ tags: - EventCode - ScriptBlockText - Computer - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_invoke_wmiexec_usage.yml b/detections/endpoint/powershell_invoke_wmiexec_usage.yml index d3fb6c0092..6fa93e58f7 100644 --- a/detections/endpoint/powershell_invoke_wmiexec_usage.yml +++ b/detections/endpoint/powershell_invoke_wmiexec_usage.yml @@ -45,7 +45,6 @@ tags: - EventCode - ScriptBlockText - Computer - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml index 39b2094dd4..6bf2374cdb 100644 --- a/detections/endpoint/powershell_load_module_in_meterpreter.yml +++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml @@ -51,7 +51,6 @@ tags: - ScriptBlockText - Computer - User_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 35211ae96d..0ec49343d4 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -61,7 +61,6 @@ tags: - Computer - UserID - EventCode - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 6974326e97..74f3e7dd69 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -64,7 +64,6 @@ tags: - Computer - UserID - Score - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_remote_services_add_trustedhost.yml b/detections/endpoint/powershell_remote_services_add_trustedhost.yml index 816ed014db..32ca512881 100644 --- a/detections/endpoint/powershell_remote_services_add_trustedhost.yml +++ b/detections/endpoint/powershell_remote_services_add_trustedhost.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - EventCode diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 842a83a2a7..f5de4ae222 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -56,7 +56,6 @@ tags: - StartAddress - dest - EventCode - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 3e9f9bcc03..8e8bf86a3a 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -53,7 +53,6 @@ tags: - Computer - UserID - EventCode - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml index be52270ead..96102d3276 100644 --- a/detections/endpoint/powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -61,7 +61,6 @@ tags: - ActivityID - Computer - ScriptBlockText - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 6299496bbb..d5097bbc2a 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index 0bc5074d26..10f65b75c0 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -46,7 +46,6 @@ tags: - EventCode - ScriptBlockText - Computer - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 7a7331ee9b..c5fb747b3a 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -60,7 +60,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 9d4027e600..083252eb62 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -59,7 +59,6 @@ tags: - ActivityID - Computer - ScriptBlockText - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 87a85983b1..eb0baf019a 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -59,7 +59,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index da6f900e38..8e73f5d7bc 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -57,7 +57,6 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index 745bfeb3a8..a57e56c9a2 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -48,7 +48,6 @@ tags: - Registry.registry_path - Registry.registry_key_name - Registry.registry_value_name - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 9de2400d2e..d8d1867a6c 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -53,7 +53,6 @@ tags: - EventCode - ComputerName - Message - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 6724c98beb..935f8bdcbf 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -53,7 +53,6 @@ tags: - EventCode - ComputerName - Message - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index b7c72ed01a..5c7ba45d78 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -60,7 +60,6 @@ tags: - Filesystem.file_path - Filesystem.file_hash - Filesystem.user - risk_score: 63 security_domain: network tests: - name: True Positive Test diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index cc20a0c14b..1caae395f3 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -62,7 +62,6 @@ tags: - ProcessID - result - _time - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 12abf7bc4c..84685ae2b2 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -52,7 +52,6 @@ tags: - Processes.user - Processes.dest - Processes.process_name - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 51df2c0834..0221b1298c 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index b74d603909..35f33cbe7c 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -52,7 +52,6 @@ tags: - file_name - file_path - file_create_time user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 15388aa291..4dc01d9f8d 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -61,7 +61,6 @@ tags: - Processes.process_name - Processes.user - Processes.dest - risk_score: 14 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml index fbf470d945..b9dae36373 100644 --- a/detections/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/endpoint/processes_tapping_keyboard_events.yml @@ -35,5 +35,4 @@ tags: - columns.name - columns.pid - host - risk_score: 25 security_domain: threat diff --git a/detections/endpoint/randomly_generated_scheduled_task_name.yml b/detections/endpoint/randomly_generated_scheduled_task_name.yml index 2520f7ecd4..0295b2d152 100644 --- a/detections/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/endpoint/randomly_generated_scheduled_task_name.yml @@ -42,5 +42,4 @@ tags: - Task_Name - Description - Command - risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/randomly_generated_windows_service_name.yml b/detections/endpoint/randomly_generated_windows_service_name.yml index b1c573d7c5..6172b09670 100644 --- a/detections/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/endpoint/randomly_generated_windows_service_name.yml @@ -41,5 +41,4 @@ tags: - Service_Type - Service_Name - Service_Start_Type - risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index ee96c13600..5bc3022972 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -54,7 +54,6 @@ tags: - dest - Image - user - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index dd186cde58..eda82d93d1 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -62,7 +62,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 674be0bb50..a7cec9cc6f 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -65,7 +65,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 9cae91bde8..8e888ffc3a 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -56,7 +56,6 @@ tags: - Processes.process - Processes.process_id - Processes.dest - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 73fea14729..c2d9ed9c9c 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 7d91a58b07..1dbe40774f 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -76,7 +76,6 @@ tags: - Registry.registry_path - Registry.dest - Registry.user - risk_score: 76 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 37468ff183..5c2c04db1b 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -59,7 +59,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 76 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index e9b532ab4f..09827bc211 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 1f32b81a7d..d92809b831 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index cdc03cbb07..f3005e34c3 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -62,7 +62,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index c392d80bd1..ea3d308fa1 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -47,7 +47,6 @@ tags: - file_create_time - file_name - file_path - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml index ae2c77d13d..4ec29dcaf8 100644 --- a/detections/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/endpoint/remote_desktop_process_running_on_system.yml @@ -44,5 +44,4 @@ tags: - Processes.dest_category - Processes.dest - Processes.user - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index fc6b5c7858..f6ba1f18bc 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 2cf26f5598..c5371659c9 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -48,7 +48,6 @@ tags: - ScriptBlockText - Computer - user_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index b3be60908b..b906903293 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 9c282dec8a..3aa274ddb3 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -49,7 +49,6 @@ tags: - Computer - UserID - EventCode - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index cd7996a4cd..d7f4f42003 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 2ff3c358b4..7e1df9942b 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index aeb3e4d36d..725db95f9b 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 542c97e39c..f16c647e35 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -47,7 +47,6 @@ tags: - Message - Computer - UserID - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index d52b53a37a..6ff3533f15 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -47,7 +47,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index 478bfe3291..9ac82824ac 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index 2a7d956376..57bcd3b9ca 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -47,7 +47,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index fa93e793fe..1c5c1923b0 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index d28ae699cc..21265d17de 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process - Processes.parent_process_id - Processes.process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 267cb8db11..020606f51b 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process - Processes.dest - Processes.user - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index 1b709cc911..75059aab21 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -58,7 +58,6 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 79340ebb5a..02c29f05ce 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -68,7 +68,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index fa3c517f28..64957ef2ea 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -70,7 +70,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index e78edcc6f6..45de676b16 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -58,7 +58,6 @@ tags: - TargetProcessId - SourceImage - SourceProcessId - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 3da210cd7d..a96c3e160f 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -46,7 +46,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 3dadfcf009..ccf163fc5c 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 7f4bd44489..3b710634d0 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -76,7 +76,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 8a0c5d6c36..0c9410f069 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -54,7 +54,6 @@ tags: - StartAddress - EventCode - dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index bc09aa98fb..1cd4b35f32 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -54,7 +54,6 @@ tags: - StartAddress - EventCode - dest - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index e77e25821f..fc7cbc9b8f 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -53,7 +53,6 @@ tags: - QueryStatus - ProcessId - dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 3dd340e8cf..af7c00ac63 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 1b49069bc7..6915261804 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -53,7 +53,6 @@ tags: - process_guid - dest - user_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index f48a79a1c9..29f5d72894 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index d4a012483a..cd1aa00c7e 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 61b451f233..cd4ba53e90 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -65,7 +65,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 56335cb81a..a5b36b1d93 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -48,7 +48,6 @@ tags: - Filesystem.file_path - Filesystem.dest - Filesystem.user - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 8ef6cbd279..ae7083f48a 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml index 2bf193709e..3c3e162a33 100644 --- a/detections/endpoint/sam_database_file_access_attempt.yml +++ b/detections/endpoint/sam_database_file_access_attempt.yml @@ -59,7 +59,6 @@ tags: - Object_Name - dest - user - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index f2db5e7aa7..4f0e37c22d 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -49,7 +49,6 @@ tags: - Filesystem.dest - Filesystem.file_name - Filesystem.file_path - risk_score: 12 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 972d6b948a..087b15483f 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index e36a232f40..6f241b5e44 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -50,7 +50,6 @@ tags: - process_id - process_name - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index f979ced7cb..ad70c6ac6d 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -52,7 +52,6 @@ tags: - Enabled - Hidden - Arguments - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 2b7b0c1245..c168bdaedd 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -54,7 +54,6 @@ tags: - Enabled - Hidden - Arguments - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 5d50547204..882d740e5d 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 365e3e1418..77e3e2c83f 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -79,7 +79,6 @@ tags: - Processes.user - Processes.parent_process_name - Processes.dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 548127b8f8..315cc8f70f 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 92539df2da..af22e316fc 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 43eefae9b0..fe1b5f12b0 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 319cb56975..109d5405d2 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 8236fb45c7..b3ddc5bbdc 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_key_name - Registry.registry_value_name - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index 6ff371fed6..c11a794cb7 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -51,7 +51,6 @@ tags: - Processes.process_name - Processes.user - Processes.dest - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 49c6139415..9a5058348d 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -65,7 +65,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index a2676c6614..15c29bd149 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 555a7adf82..54b7b23443 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -53,7 +53,6 @@ tags: - parent_process_name - dest_port - process_path - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 6c32388ea0..e4b5cb6aa6 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -59,7 +59,6 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index 605dca4340..cf103c1bc2 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -67,7 +67,6 @@ tags: - Computer - UserID - EventCode - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index b4f7892bb1..2ed8235964 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -77,7 +77,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index ef478199f7..3c605f1555 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -60,7 +60,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 76 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/services_lolbas_execution_process_spawn.yml b/detections/endpoint/services_lolbas_execution_process_spawn.yml index 79b5cf4205..a233754e44 100644 --- a/detections/endpoint/services_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_lolbas_execution_process_spawn.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 47d9c3c06d..1afa6c3807 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -70,7 +70,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 12480258a4..40da5d44b2 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -50,7 +50,6 @@ tags: - Filesystem.file_path - Filesystem.file_name - Filesystem.dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 854ee45615..56fe163b87 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 21a8916599..fdc61b38f9 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -53,7 +53,6 @@ tags: - Task_Name - Description - Command - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 73372196c4..a7526ce8dc 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -50,7 +50,6 @@ tags: - All_Changes.result_id - All_Changes.user - All_Changes.dest - risk_score: 63 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 18d5461718..8521586aee 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -65,7 +65,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 3dd0e048eb..ab0c13e5b8 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -52,7 +52,6 @@ tags: - Processes.user - Processes.process - Processes.process_name - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 7966541314..fb5813e876 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -61,7 +61,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index 0304c83a8d..31255d3c41 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -59,7 +59,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml index 0c4a0d86d3..22394f3fd5 100644 --- a/detections/endpoint/spike_in_file_writes.yml +++ b/detections/endpoint/spike_in_file_writes.yml @@ -35,5 +35,4 @@ tags: - _time - Filesystem.action - Filesystem.dest - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index aae8fec6da..f2f15aa9d2 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -64,7 +64,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 04a49c2bdc..d4cc628847 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -49,7 +49,6 @@ tags: - dest - EventCode - ImageLoaded - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 1a2becf8d9..e7bfc3ebd2 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -60,7 +60,6 @@ tags: - GrantedAccess - CallTrace - EventCode - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index c3a169b9b5..1102b0041c 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -62,7 +62,6 @@ tags: - Processes.process_id - Processes.process_name - Processes.dest - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 6b93ddcb2b..450b0ba03f 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -62,7 +62,6 @@ tags: - file_path - file_name - TargetFilename - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index 8b1d0dcafc..b4ca7759f4 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -51,7 +51,6 @@ tags: - EventCode - ProcessId - Image - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml index a49f8ebc41..0cedefbf41 100644 --- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml +++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - All_Risk.analyticstories - All_Risk.risk_object_type diff --git a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml index 62b7121d16..c6b632b71a 100644 --- a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -37,5 +37,4 @@ tags: - EventCode - ImageLoaded - QueryName - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index 792202ed3d..16d968fc32 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -58,7 +58,6 @@ tags: - Caller_User_Name - OldTargetUserName - NewTargetUserName - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index edcfdab358..e28d40570f 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml index 0e42418e42..7e49da5fa7 100644 --- a/detections/endpoint/suspicious_curl_network_connection.yml +++ b/detections/endpoint/suspicious_curl_network_connection.yml @@ -49,5 +49,4 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 7a22a358a1..555a418cee 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 7ef8927ae7..1bff27ee4f 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -58,7 +58,6 @@ tags: - IMPHASH - Signature - Signed - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 142a4c048c..a70853a248 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -41,7 +41,6 @@ tags: - _time - EventCode - dest - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 96b9cb8a66..f7a2ee1c89 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 08ce325284..155b803f95 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 26dbf83691..785ebf6728 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -54,7 +54,6 @@ tags: - process_name - process_path - process - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index 207c2423f6..f8cc88379e 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -56,7 +56,6 @@ tags: - Account_Name - Client_Address - Failure_Code - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml index e608d0e559..add30cc8fb 100644 --- a/detections/endpoint/suspicious_linux_discovery_commands.yml +++ b/detections/endpoint/suspicious_linux_discovery_commands.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_name - Processes.user - Processes.process_name - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index e4a80bb382..2a51839e52 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 7af0cd38d9..d16bacb452 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 200b63cf90..3cc932f071 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index aa285cf61f..aad6c213cc 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 7571102809..5e0996644a 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 9a0d7e5043..e5ae6344cc 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -61,7 +61,6 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index 37b7c1ad33..33c616fa81 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml index 7584612055..ac67564bd0 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage.yml @@ -47,5 +47,4 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index b236e4924a..d4a3ed2add 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -34,5 +34,4 @@ tags: required_fields: - _time - columns.cmdline - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 4a93d65c78..0157a3a692 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -58,7 +58,6 @@ tags: - process_name - QueryResults - dest - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 9df0d6caa8..67ff44c942 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process - Processes.process - Processes.user - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 3e1dfcb331..7cafbe27e5 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -91,7 +91,6 @@ tags: - Processes.process_path - Processes.dest - Processes.user - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 0b0c6271d8..dc07797821 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -56,7 +56,6 @@ tags: - process_name - QueryResults - dest - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index f9111c32ce..ca2085dd62 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -65,7 +65,6 @@ tags: - Processes.dest - Processes.process_id - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 26de11f9ea..51cce08869 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -75,7 +75,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 6bb090a30a..a093ed2c68 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -76,7 +76,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml index c664963261..5315cc037d 100644 --- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index ca8308219a..9253ac8d57 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 826c9fbeb8..cb2a3a1ac6 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 3b2a40cac0..7c163e3b76 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -66,7 +66,6 @@ tags: - Processes.process_name - Processes.process_id - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 83f14d4a30..0e962bdd16 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml index 935d91db0d..343caae002 100644 --- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -47,5 +47,4 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml index 345f652f7d..bca1bf752a 100644 --- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml +++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml @@ -44,7 +44,6 @@ tags: - New_Account_Name - Account_Name - ComputerName - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 6f5a895eba..e4bf5b924e 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -57,7 +57,6 @@ tags: - process_name - process_path - process - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index b943b6f210..35b6ef0c60 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 54254dde8a..ccfc5a3193 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_name - Processes.process_id - Processes.dest - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 3f8ec89a97..573e004e62 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index d566e013b0..016be35821 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -50,7 +50,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 6cf3344a8c..28e61a488a 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -54,7 +54,6 @@ tags: - Processes.user - Processes.process_name - Processes.dest - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 0bd390af5d..6c3dc37647 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -63,7 +63,6 @@ tags: - Processes.process_id - Processes.parent_process_name - Processes.process_hash - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 2829746088..96055bf615 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 18ab748408..aca557de30 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -50,7 +50,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 16f1e81dea..8ef15441b6 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -59,7 +59,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 7038c0b9e5..102b9ccd80 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -55,7 +55,6 @@ tags: - signature - Image - process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 46d6c1608e..8c5327c59c 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -52,7 +52,6 @@ tags: - dest - EventCode - Company - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index d68f8c25fb..07865ead2e 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -55,7 +55,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 75e2c8de26..35414e2794 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index 3b3a9594d3..4d09d5afb8 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -53,7 +53,6 @@ tags: - Processes.process_path - Processes.process - Processes.parent_process_name - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index a2a669e459..53329f735f 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index a2fadb67eb..9f024415ed 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -54,7 +54,6 @@ tags: - Computer - UserID - EventCode - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml index f8ede9c340..8e7e9a22a6 100644 --- a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -41,5 +41,4 @@ tags: - dest - service - service_id - risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 0d6fa27f5d..04d468ae38 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -69,7 +69,6 @@ tags: - Service_Name - service_id - Client_Address - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index 7bc1ff16b7..a28540543b 100644 --- a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -40,5 +40,4 @@ tags: - Security_ID - Account_Name - ComputerName - risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 3feac13ffb..b574da1b90 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -43,5 +43,4 @@ tags: - Processes.dest - Processes.process_name - Processes.process - risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml index 42ad5a5b3f..084a5c0d8f 100644 --- a/detections/endpoint/unusually_long_command_line___mltk.yml +++ b/detections/endpoint/unusually_long_command_line___mltk.yml @@ -43,5 +43,4 @@ tags: - Processes.dest - Processes.process_name - Processes.process - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 149aff1ced..a8d554402f 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -46,7 +46,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 126881a041..3c274d5ac8 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -43,7 +43,6 @@ tags: - ComputerName - User - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 68b1758de5..b76c7561d4 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -50,7 +50,6 @@ tags: - Processes.user - Processes.parent_process_name - Processes.dest - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 9721d41cd5..433f054b79 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -63,7 +63,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 7d7fcaf26e..77952e0626 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index c4f09f596c..495589eb64 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -72,7 +72,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 93c6eb6824..a2cbda5f3d 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 0f97c7f8d8..ee7db518ce 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -55,7 +55,6 @@ tags: - ProcessId - Hashes - IMPHASH - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index e519b0b582..4f7da7eb01 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -52,7 +52,6 @@ tags: - QueryResults - dest - EventCode - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 943b40cf46..2104203a16 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -49,7 +49,6 @@ tags: - dest - EventCode - ProcessId - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 9dbdc073c5..652e24b34a 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 7588d7bf5b..b8a25ece26 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml index 766d58bed0..b888c94540 100644 --- a/detections/endpoint/windows_abused_web_services.yml +++ b/detections/endpoint/windows_abused_web_services.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Image diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index dcbbc013b3..6b7afb9300 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -61,7 +61,6 @@ tags: - member_dn - ComputerName - user - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index 47ccaee603..d904cc3f75 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -49,7 +49,6 @@ tags: - CallTrace - dest - user_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index f456343e17..ee8e62e694 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -58,7 +58,6 @@ tags: - CallTrace - dest - user_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml index b34524f65f..d1b73944f7 100644 --- a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml +++ b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml @@ -35,7 +35,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - ScriptBlockText diff --git a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml index cec3944cd2..16f898be86 100644 --- a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml +++ b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - ScriptBlockText diff --git a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml index 17c069bc3a..522ebf2efe 100644 --- a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml +++ b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml @@ -31,7 +31,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - ScriptBlockText diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index 3bbe348601..f2f10474ac 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -50,7 +50,6 @@ tags: - ObjectName - EventCode - SubjectUserName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 7278ed7266..b922bf1bc8 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -60,7 +60,6 @@ tags: - Computer - SubjectUserName - AttributeValue - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 11f074b032..08b9198623 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -57,7 +57,6 @@ tags: - user - src_user - Logon_ID - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index a14826df9b..c9cf51db8c 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -45,7 +45,6 @@ tags: - EventCode - AuditPolicyChanges - SubcategoryGuid - risk_score: 60 security_domain: endpoint manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested tests: diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml index 91ead7485b..2c13d4d040 100644 --- a/detections/endpoint/windows_ad_domain_controller_promotion.yml +++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml @@ -48,7 +48,6 @@ tags: - user - Logon_ID - dvc - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index a8ac8bc233..3792ff5de9 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -53,7 +53,6 @@ tags: - AttributeLDAPDisplayName - AttributeValue - ObjectClass - risk_score: 80 security_domain: endpoint manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. tests: diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml index 2bd28e3e49..5604dd55c2 100644 --- a/detections/endpoint/windows_ad_dsrm_account_changes.yml +++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_path - Registry.dest - Registry.user - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 377174fb96..e164a90f81 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -52,7 +52,6 @@ tags: - All_Changes.dest - All_Changes.src - All_Changes.user - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index aa1529de0d..64df8fe865 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -51,7 +51,6 @@ tags: - user - src_user - Logon_ID - risk_score: 90 security_domain: endpoint manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. tests: diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index b6c78f36bf..54bb65bd30 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -55,7 +55,6 @@ tags: - EventCode - Computer - SubjectUserName - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 258b53af8f..478fc0a737 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -64,7 +64,6 @@ tags: - ObjectType - OperationType - status - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 7aea6dbd89..f457e83f5f 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -65,7 +65,6 @@ tags: - ObjectType - OperationType - status - risk_score: 100 security_domain: endpoint manual_test: This detection runs correctly when run manually and given some time is given for data to settle in the splunk index. tests: diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index f8a726c1c9..f31376effa 100644 --- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -59,7 +59,6 @@ tags: - user - src_user - Logon_ID - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml index 33fcf5b2f0..200c4727b4 100644 --- a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml +++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml @@ -70,7 +70,6 @@ tags: - signature - SubjectUserName - Computer - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index 4e50edd550..d48621cab8 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -50,7 +50,6 @@ tags: - signature - SubjectUserName - Computer - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml index c6051c7714..177d6dede2 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml @@ -56,7 +56,6 @@ tags: - ObjectDN - Logon_ID - signature - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index db574e9d18..f1640e4f9c 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -57,7 +57,6 @@ tags: - signature - SubjectUserName - Computer - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml index 429e177649..650d71c661 100644 --- a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml +++ b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml @@ -53,7 +53,6 @@ tags: - Computer - SubjectUserName - AttributeValue - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml index 4ede43d2ff..c4d859b7bc 100644 --- a/detections/endpoint/windows_admin_permission_discovery.yml +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Filesystem.file_path diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index 481e1aa230..58208d8a34 100644 --- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -57,7 +57,6 @@ tags: - Computer - IpAddress - SubjectUserName - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index 2f7c780133..1fcee629d8 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -53,7 +53,6 @@ tags: - displayName - gPCFileSysPath - dcName - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index bea6685566..24c387e6ef 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -53,7 +53,6 @@ tags: - displayName - gPCFileSysPath - dcName - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml index fbd6af92e9..cf29606d34 100644 --- a/detections/endpoint/windows_alternate_datastream___base64_content.yml +++ b/detections/endpoint/windows_alternate_datastream___base64_content.yml @@ -60,7 +60,6 @@ tags: - Contents - file_hash - process_guid - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index 13fcf8e761..8387c6c3fa 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -64,7 +64,6 @@ tags: - file_hash - process_guid - IMPHASH - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_alternate_datastream___process_execution.yml b/detections/endpoint/windows_alternate_datastream___process_execution.yml index 4bf821580d..397302221d 100644 --- a/detections/endpoint/windows_alternate_datastream___process_execution.yml +++ b/detections/endpoint/windows_alternate_datastream___process_execution.yml @@ -62,7 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml index e9ef61c91e..fd08695862 100644 --- a/detections/endpoint/windows_apache_benchmark_binary.yml +++ b/detections/endpoint/windows_apache_benchmark_binary.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml index 038ef8e031..641c1cf11d 100644 --- a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml @@ -53,7 +53,6 @@ tags: - dest - UserID - SecurityID - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index a09511becb..a55fc410ff 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -52,7 +52,6 @@ tags: - dest - UserID - SecurityID - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index 8dceccefbc..d5b601fc37 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -50,7 +50,6 @@ tags: - PipeName - dest - UserID - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml index 0b0c3c6790..de36b57c2a 100644 --- a/detections/endpoint/windows_applocker_block_events.yml +++ b/detections/endpoint/windows_applocker_block_events.yml @@ -49,7 +49,6 @@ tags: - TargetProcessId - FilePath - FullFilePath - risk_score: 16 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml b/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml index 324d566b0d..5da8951f37 100644 --- a/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml +++ b/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml @@ -35,7 +35,6 @@ tags: - FullFilePath - dest - user - risk_score: 49 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml index a1e62f912e..576cbf6b58 100644 --- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml +++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml @@ -44,7 +44,6 @@ tags: - Computer - FullFilePath - TargetUser - risk_score: 64 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_applocker_rare_application_launch_detection.yml b/detections/endpoint/windows_applocker_rare_application_launch_detection.yml index 9698a56585..4b7293df30 100644 --- a/detections/endpoint/windows_applocker_rare_application_launch_detection.yml +++ b/detections/endpoint/windows_applocker_rare_application_launch_detection.yml @@ -35,7 +35,6 @@ tags: - FullFilePath - dest - user - risk_score: 15 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_archive_collected_data_via_powershell.yml b/detections/endpoint/windows_archive_collected_data_via_powershell.yml index 2b1883e29d..10508dc420 100644 --- a/detections/endpoint/windows_archive_collected_data_via_powershell.yml +++ b/detections/endpoint/windows_archive_collected_data_via_powershell.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - EventCode diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 560c0ce1dd..2839a94042 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml b/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml index 3e1b07f39e..192f09f217 100644 --- a/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml +++ b/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml @@ -58,7 +58,6 @@ tags: - Filesystem.file_name - Filesystem.user - Filesystem.file_path - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_autoit3_execution.yml b/detections/endpoint/windows_autoit3_execution.yml index bfa49d58ee..2e7c0ba389 100644 --- a/detections/endpoint/windows_autoit3_execution.yml +++ b/detections/endpoint/windows_autoit3_execution.yml @@ -56,7 +56,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index 0c04246d29..aa9ba8fe92 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -50,7 +50,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index 38be3b1a49..168144cbf5 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 743156d77b..ee35b8a0c5 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -58,7 +58,6 @@ tags: - Filesystem.file_path - Filesystem.process_guid - Filesystem.dest - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_bootloader_inventory.yml b/detections/endpoint/windows_bootloader_inventory.yml index e32c7b076d..6f84f5ab91 100644 --- a/detections/endpoint/windows_bootloader_inventory.yml +++ b/detections/endpoint/windows_bootloader_inventory.yml @@ -37,5 +37,4 @@ tags: required_fields: - _time - _raw - risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml index b6e9d36f7f..e7faf6e938 100644 --- a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml +++ b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 9 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index c758e1d1de..dbe74199ea 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 5 required_fields: - Filesystem.dest - Filesystem.action diff --git a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml index ae84280fa2..4f09fcd057 100644 --- a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml +++ b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml index 575afb3786..77d90779dc 100644 --- a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml +++ b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml index 891dc16947..5092da4d5c 100644 --- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml +++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml @@ -54,7 +54,6 @@ tags: - Computer - UserID - EventCode - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 7ba973793c..840aed547a 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -59,7 +59,6 @@ tags: - Splunk Cloud required_fields: - UPDATE - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index a0fd469474..796995c1ba 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -47,7 +47,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 16d4fb56c3..cfa6ce1bf6 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index da45330e83..aef3281268 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/endpoint/windows_command_shell_fetch_env_variables.yml index 156004d4aa..1a827cda36 100644 --- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml +++ b/detections/endpoint/windows_command_shell_fetch_env_variables.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index b96b349845..cd61d6ab4b 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -55,7 +55,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - All_Risk.analyticstories diff --git a/detections/endpoint/windows_computer_account_created_by_computer_account.yml b/detections/endpoint/windows_computer_account_created_by_computer_account.yml index f87e60cb45..445a0fa187 100644 --- a/detections/endpoint/windows_computer_account_created_by_computer_account.yml +++ b/detections/endpoint/windows_computer_account_created_by_computer_account.yml @@ -52,7 +52,6 @@ tags: - Account_Name - Subject_Account_Name - Subject_Account_Domain - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml index 5d9c9d7b3e..6242ba9f01 100644 --- a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml +++ b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml @@ -50,7 +50,6 @@ tags: - user - Account_Name - src_ip - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_computer_account_with_spn.yml b/detections/endpoint/windows_computer_account_with_spn.yml index f9fad548d7..5dd93eb784 100644 --- a/detections/endpoint/windows_computer_account_with_spn.yml +++ b/detections/endpoint/windows_computer_account_with_spn.yml @@ -52,7 +52,6 @@ tags: - SAM_Account_Name - DNS_Host_Name - Logon_Id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_conhost_with_headless_argument.yml b/detections/endpoint/windows_conhost_with_headless_argument.yml index efae2991f8..563fd557a8 100644 --- a/detections/endpoint/windows_conhost_with_headless_argument.yml +++ b/detections/endpoint/windows_conhost_with_headless_argument.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 70 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index 28855abc84..e41ea6f7d4 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -50,7 +50,6 @@ tags: - All_Changes.dest - All_Changes.result - All_Changes.action - risk_score: 18 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 8a86eeed91..520b946189 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -52,7 +52,6 @@ tags: - process_id - EventCode - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 7bd4cb9694..1a716eb6a6 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml index fc1f0419c0..c8ad05d332 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml @@ -59,7 +59,6 @@ tags: - Filesystem.file_name - Filesystem.user - Filesystem.file_path - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index 7ac3af8b11..956a7b4d6e 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -60,7 +60,6 @@ tags: - process_id - EventCode - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index a441c298e5..a741b01e13 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -62,7 +62,6 @@ tags: - process_id - EventCode - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index f5906eef02..af6696b330 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -62,7 +62,6 @@ tags: - process_id - EventCode - dest - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_password_stores_creation.yml b/detections/endpoint/windows_credentials_from_password_stores_creation.yml index 789883a3db..4df5a33762 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_creation.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_creation.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml index c9b598ae9e..9a9980a761 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml index 7ebede5ea1..7fc57bc97c 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_query.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml index 1c02d241f5..4b149cdb0d 100644 --- a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml +++ b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml @@ -59,7 +59,6 @@ tags: - Filesystem.file_name - Filesystem.user - Filesystem.file_path - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml index d42f2d9df7..8f8e198254 100644 --- a/detections/endpoint/windows_credentials_in_registry_reg_query.yml +++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 55da57416f..69f832ed1c 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index b0c9164e40..0d3e281d18 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml index 474a808302..adb6936e6b 100644 --- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -60,7 +60,6 @@ tags: - signature_id - process_name - process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_debugger_tool_execution.yml b/detections/endpoint/windows_debugger_tool_execution.yml index 3d47e73552..50cadd25ef 100644 --- a/detections/endpoint/windows_debugger_tool_execution.yml +++ b/detections/endpoint/windows_debugger_tool_execution.yml @@ -47,7 +47,6 @@ tags: - Processes.user - Processes.process_id - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index f16f240923..02775a5978 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -56,7 +56,6 @@ tags: - process_name - process_path - process - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index bc24c42541..ef15ade210 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -58,7 +58,6 @@ tags: - DSName - AttributeValue - SubjectUserSid - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml index 6b20831e80..9eb7d51a69 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml index 0381c2fa6b..ef983f3f42 100644 --- a/detections/endpoint/windows_defender_asr_audit_events.yml +++ b/detections/endpoint/windows_defender_asr_audit_events.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 5 required_fields: - host - Process_Name diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 5ff8ed519b..fc29136d59 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -51,7 +51,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - host - Process_Name diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index 17420d6e22..7b0661a7ed 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -32,7 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - host - New_Value diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml index ec7a0c62cc..d5f79a47d9 100644 --- a/detections/endpoint/windows_defender_asr_rule_disabled.yml +++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - host - New_Value diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml index a9882d1b2b..fadaf5633a 100644 --- a/detections/endpoint/windows_defender_asr_rules_stacking.yml +++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - host - Parent_Commandline diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 1ac9985d12..904c336a87 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -60,7 +60,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index 13706abb70..bc5f130454 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 6988eed160..a7a440b7d8 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -58,7 +58,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 388e9558db..bf323a39a1 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -50,7 +50,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index cc98e22380..8bef8d7de7 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 1ec8cd17fc..a0a65105d3 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 0e2affadac..cb4a6d22c7 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -57,7 +57,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index 562f6aa3e9..c6371c0692 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -54,7 +54,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 83ba19116d..d30a554cd6 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 865efdcd6b..7efc1aa135 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index e2dec3c377..b0f66ff8ef 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -50,7 +50,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 9294083710..fc16ef5ec4 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -75,7 +75,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index be4a054e3e..eeab4f1cac 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -54,7 +54,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index 79df8a447c..482bbb400b 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -55,7 +55,6 @@ tags: - Registry.dest - Registry.user - Registry.registry_path - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 10e8b7080c..4b736d996b 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index f0ccdbbf7d..dddb49cb9d 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -52,7 +52,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.original_file_name - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml index bd6bea68a1..5ea4e5193e 100644 --- a/detections/endpoint/windows_dism_install_powershell_web_access.yml +++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml @@ -52,7 +52,6 @@ tags: - process - process_id - parent_process_id - risk_score: 72 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 6e02d79915..da15716ca6 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: access tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index 0a6fcc9609..186fc07d5c 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -39,7 +39,6 @@ tags: - dest - ImageLoaded - Module_Path - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index 1b06631f9e..cf26ffad29 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index a2fa7b4b0d..71e93c65df 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -52,7 +52,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml index db497309f9..e0c7d58255 100644 --- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml index 1bc6eb6502..d14c5992b6 100644 --- a/detections/endpoint/windows_dns_gather_network_info.yml +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml index 1ad888380e..27f95111ca 100644 --- a/detections/endpoint/windows_dnsadmins_new_member_added.yml +++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml @@ -51,7 +51,6 @@ tags: - Computer - MemberSid - TargetUserName - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml index 6a61fdb6f5..566208d19f 100644 --- a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml +++ b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - ScriptBlockText diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index d914bab0d1..08a1935107 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 80 required_fields: - _time, - EventCode diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index 965333e905..2c70fe5773 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -78,7 +78,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_driver_inventory.yml b/detections/endpoint/windows_driver_inventory.yml index b5f5e7b05b..2758a17dfa 100644 --- a/detections/endpoint/windows_driver_inventory.yml +++ b/detections/endpoint/windows_driver_inventory.yml @@ -35,7 +35,6 @@ tags: - Path - host - DriverType - risk_score: 5 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index f4c48b9e35..c2b839e21e 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -64,7 +64,6 @@ tags: - ImagePath - ServiceName - ServiceType - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index c178301c19..dc50b119ee 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -46,7 +46,6 @@ tags: - service_signature_verified - service_signature_exists - Hashes - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_enable_powershell_web_access.yml b/detections/endpoint/windows_enable_powershell_web_access.yml index fb8dea6a41..7a2ba60e59 100644 --- a/detections/endpoint/windows_enable_powershell_web_access.yml +++ b/detections/endpoint/windows_enable_powershell_web_access.yml @@ -48,7 +48,6 @@ tags: - ScriptBlockText - dest - UserID - risk_score: 72 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml index 23e3d47b27..76fa24b0da 100644 --- a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml +++ b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml @@ -54,7 +54,6 @@ tags: - Registry.user - Registry.registry_value_name - Registry.registry_value_type - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_esx_admins_group_creation_security_event.yml b/detections/endpoint/windows_esx_admins_group_creation_security_event.yml index a9f49f4fd4..83a4e81a90 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_security_event.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_security_event.yml @@ -57,7 +57,6 @@ tags: - SubjectUserName - SubjectDomainName - Computer - risk_score: 25 security_domain: endpoint cve: - CVE-2024-37085 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index a9f24eefc5..9dee1b8382 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.original_file_name - risk_score: 56 security_domain: endpoint cve: - CVE-2024-37085 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml index 8f504ab250..06992495f5 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml @@ -53,7 +53,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 0668edd350..cd03b4ee88 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -40,7 +40,6 @@ tags: - Message - User - Sid - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 116e078f96..2cae4b5ddc 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -53,7 +53,6 @@ tags: - _time - EventCode - dest - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index a324abb208..48a785b3d5 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -38,7 +38,6 @@ tags: - Exit_Code - dest - EventCode - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml index b214091034..2cd18880ff 100644 --- a/detections/endpoint/windows_excessive_disabled_services_event.yml +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -50,7 +50,6 @@ tags: - Message - User - Sid - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml index f3d8824e6e..6ae2630da2 100644 --- a/detections/endpoint/windows_executable_in_loaded_modules.yml +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -40,7 +40,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Image diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index f0ddb9c368..688e8cea67 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index 1a56c51eab..896774f898 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -47,7 +47,6 @@ tags: - Computer - UserID - EventCode - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index a23b81b5f8..4f78b790f5 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -47,7 +47,6 @@ tags: - Computer - UserID - EventCode - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml index 4b1e6c2e1e..70dfa3ab20 100644 --- a/detections/endpoint/windows_export_certificate.yml +++ b/detections/endpoint/windows_export_certificate.yml @@ -47,7 +47,6 @@ tags: - dest - SubjectName - UserData_Xml - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index 4c2410e198..8d8612f796 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -57,7 +57,6 @@ tags: - Opcode - Computer - UserID - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index e98c25a420..92206bec1e 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -55,7 +55,6 @@ tags: - DestinationIp - dest - user - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 892f4f6c0d..6cafb7c27c 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -53,7 +53,6 @@ tags: - Processes.dest - Processes.process_guid - Processes.user - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index 58b87f0109..81f91b9ac1 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Processes.parent_process_name diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index 16e1e19180..cc5f7790e7 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -53,7 +53,6 @@ tags: - Message - Computer - UserID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index c297114997..48125cf43a 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -53,7 +53,6 @@ tags: - Message - Computer - UserID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index c788f1835b..d5c7e1af0e 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -64,7 +64,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.original_file_name - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 1faa59f8cc..350f33b270 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -53,7 +53,6 @@ tags: - Message - Computer - UserID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index ef1c3fc456..7400266297 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -52,7 +52,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 8096ec6259..769f44eb37 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -41,7 +41,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml index b1d1e1a8f0..a1480204ec 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -45,7 +45,6 @@ tags: - QueryResults - dest - EventCode - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml index 787345751e..0618321580 100644 --- a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml @@ -54,7 +54,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 7278da4e3c..a1f09ceb06 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -53,7 +53,6 @@ tags: - Message - Computer - UserID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index e53ead572a..fb69e13b70 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -59,7 +59,6 @@ tags: - ObjectDN - ObjectGUID - Computer - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml index 3d1ed6571c..fb543adcd7 100644 --- a/detections/endpoint/windows_hidden_schedule_task_settings.yml +++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml @@ -54,7 +54,6 @@ tags: - Enabled - Hidden - Arguments - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 2b2cf67dde..b50bd3e497 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -51,7 +51,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 91e856414c..564982f177 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -69,7 +69,6 @@ tags: - Image - ProcessID - _time - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml index 9278044b65..6bbcec4ea8 100644 --- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml +++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml @@ -50,7 +50,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index c2ae850c07..f52757bbc0 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -50,7 +50,6 @@ tags: - SourceProcessId - SourceUser - TargetUser - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index ec62c76be2..c0ebc30361 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -40,7 +40,6 @@ tags: - dest - TargetServerName - ProcessName - risk_score: 64 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 5299a3c22a..c11a195a5c 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 6 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index 58cef41331..6c459ccc21 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml index 2febc40bd3..61d5352ad9 100644 --- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml +++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml @@ -40,7 +40,6 @@ tags: - host - name - image - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_iis_components_module_failed_to_load.yml b/detections/endpoint/windows_iis_components_module_failed_to_load.yml index 1bcc9ddeae..8ba39338af 100644 --- a/detections/endpoint/windows_iis_components_module_failed_to_load.yml +++ b/detections/endpoint/windows_iis_components_module_failed_to_load.yml @@ -53,7 +53,6 @@ tags: - EventCode - ComputerName - Message - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml index 8c34e99e1e..5471f56ce0 100644 --- a/detections/endpoint/windows_iis_components_new_module_added.yml +++ b/detections/endpoint/windows_iis_components_new_module_added.yml @@ -53,7 +53,6 @@ tags: - EventCode - ComputerName - Message - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml index d2c3561749..c3f07a9b95 100644 --- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml +++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml @@ -42,7 +42,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml index 0ffd185745..11919863a1 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml index 08fc1eb735..3c810683d5 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml index 319aa68858..b9f07da267 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml index e41062773b..f9f8238599 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml index 8d08fde3ab..37aa9e2f62 100644 --- a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml +++ b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml index a4ce5e139f..737a37b0f5 100644 --- a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml +++ b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 08ab50b0ce..32329d9f35 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -43,7 +43,6 @@ tags: - Registry.user - Registry.registry_path - Registry.action - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index 1ad1a12b13..6ccccdd7f7 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.user - Registry.registry_path - Registry.action - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml index 800d6c7f61..fc463b45ae 100644 --- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml index 8ce7b98edd..875e151671 100644 --- a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml +++ b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml index a8a69f4b55..2354e77431 100644 --- a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml +++ b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml index 9370d32c3c..60fcf1c2db 100644 --- a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml +++ b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml index 8c47ab8d19..19e44c7bda 100644 --- a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml +++ b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml index 81b8ba5c1e..6adaf8235b 100644 --- a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml +++ b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml index db5aff8776..db3f64568a 100644 --- a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml +++ b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml index 83218b9b01..307d13e532 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml index e91808e878..f80f278871 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml index 2f2fcac705..bd2118d25e 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml index 7ca36c1a80..61cf44a228 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml index 871b7fdb87..7ec7078d44 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml index 91185eb74c..d762a189ed 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml index 9c6c7fa00b..9e46e80641 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml index 1df570e032..fece49084d 100644 --- a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml +++ b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml index aa6dff806f..f08ebe9a87 100644 --- a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml +++ b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml index 23d3ca4092..508132648d 100644 --- a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml +++ b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml index 356c13ac86..c52613d08f 100644 --- a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml +++ b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 98f79b8954..d318c8a7c3 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -54,7 +54,6 @@ tags: - Registry.action - Registry.user - Registry.dest - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 3b2738b061..afe030ffd3 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -53,7 +53,6 @@ tags: - Registry.user - Registry.registry_path - Registry.action - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index c022e3893a..26bec1b218 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 538eef61ae..a7e0cc7c3f 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -57,7 +57,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.process_path - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 43647e5f6c..5b9c524db7 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -56,7 +56,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.process_path - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index 091ecbc8ee..9cc1d10e7e 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml index 62a9cb9657..62bc7ca12d 100644 --- a/detections/endpoint/windows_information_discovery_fsutil.yml +++ b/detections/endpoint/windows_information_discovery_fsutil.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index d9a303b109..a096f1e262 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml index 35623e1240..99c2dbe7eb 100644 --- a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml +++ b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.process_guid - Registry.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index af811a8eaa..4583ee83a2 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -42,7 +42,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 5dcabf46d1..b8862f660f 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index b2a5405852..92ac115f28 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -79,7 +79,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index eaf65c0c1f..3d00d85d70 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -70,7 +70,6 @@ tags: - Ports.process_guid - Ports.dest - Ports.dest_port - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 29d954d54c..ee1de90a27 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 791f06e74e..ef859e2625 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -72,7 +72,6 @@ tags: - Ports.process_guid - Ports.dest - Ports.dest_port - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index abe394247e..d2bca66066 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 90eabdb216..0711935733 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -52,7 +52,6 @@ tags: - Filesystem.file_name - Filesystem.file_path - Filesystem.dest - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 542814745e..9268f06728 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -64,5 +64,4 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index 170fd211dc..07ccd15178 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -50,7 +50,6 @@ tags: - user - TargetUserName - src_ip - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index d1996b5d71..7cda1e80dd 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -72,7 +72,6 @@ tags: - Filesystem.file_name - Filesystem.file_path - Filesystem.process_guid - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 17d76102de..89832fc2db 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -60,7 +60,6 @@ tags: - ImageLoaded - Computer - ProcessGuid - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml index e52939872d..a78f4ff6f0 100644 --- a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml +++ b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Image diff --git a/detections/endpoint/windows_krbrelayup_service_creation.yml b/detections/endpoint/windows_krbrelayup_service_creation.yml index bffd9e712f..1415ed8266 100644 --- a/detections/endpoint/windows_krbrelayup_service_creation.yml +++ b/detections/endpoint/windows_krbrelayup_service_creation.yml @@ -47,7 +47,6 @@ tags: - Service_Name - Service_Start_Type - Service_Type - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index 366c9748e9..0be5a1fa7c 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -50,7 +50,6 @@ tags: - ServiceName - TargetUserName - IpAddress - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml index 19a7cc815e..bed5dd0c11 100644 --- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml +++ b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index 43e14d040d..75ecdde2e4 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index bffdebe91a..c22da2f4ce 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -50,7 +50,6 @@ tags: - ScriptBlockText - Computer - user_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index df396b920c..2ce5c02e5d 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -59,7 +59,6 @@ tags: - TargetUserName - Computer - IpAddress - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index e40bdd0830..52f7025132 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -62,7 +62,6 @@ tags: - Processes.process_name - Processes.original_file_name - Processes.process_path - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index db892d5a50..046806195f 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -61,7 +61,6 @@ tags: - Processes.process_name - Processes.original_file_name - Processes.process_path - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml index da3ce68a68..47157bb8e0 100644 --- a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml +++ b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Registry.registry_path diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index 30348e0e6c..ca3b974966 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -54,7 +54,6 @@ tags: - DestinationIp - dest - user - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index 84aa37f7d8..1dbb50b293 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - EventCode - TargetFilename diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml index 3f7a157961..a998e5f5e4 100644 --- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml +++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_masquerading_msdtc_process.yml b/detections/endpoint/windows_masquerading_msdtc_process.yml index 7fbae42721..07b9521ae1 100644 --- a/detections/endpoint/windows_masquerading_msdtc_process.yml +++ b/detections/endpoint/windows_masquerading_msdtc_process.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index 4f5beddb42..47ec24bb05 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -74,7 +74,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 81b30b8bc5..a8e96421cb 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -48,7 +48,6 @@ tags: - Filesystem.file_create_time - Filesystem.file_name - Filesystem.file_path - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index a48c572643..dbfbf61c0d 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml index 63086364fc..6a1ab4d7b9 100644 --- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml +++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml @@ -41,7 +41,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 50f3afbc53..dc3f179d72 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml index c265873f9f..9fae1a6567 100644 --- a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml +++ b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml @@ -51,7 +51,6 @@ tags: - Registry.action - Registry.registry_value_data - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_default_icon_setting.yml b/detections/endpoint/windows_modify_registry_default_icon_setting.yml index 3b7ef59d02..fec44953ab 100644 --- a/detections/endpoint/windows_modify_registry_default_icon_setting.yml +++ b/detections/endpoint/windows_modify_registry_default_icon_setting.yml @@ -54,7 +54,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.action - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml index 4e6cf4097a..9083841810 100644 --- a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml +++ b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml @@ -53,7 +53,6 @@ tags: - Image - user - dest - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index 16e56f5a6d..f2238da3ad 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -51,7 +51,6 @@ tags: - Registry.action - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml index 6dbf834481..679285bef2 100644 --- a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml +++ b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Registry.registry_path diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index b100e905f8..6e06ef6050 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -50,7 +50,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index f84d8c4f04..e34bce563f 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index 1a0fbcafd4..0b190757b0 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index 0c7359a41a..ccb38bd748 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index e8aed5c3e9..f85e9d3ddc 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 91998ef864..ff5eb01d40 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index 1f02d96160..13edac5f6a 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index 1bb85e7e02..afc9b0e764 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -49,7 +49,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index f6ab2c2c16..ff43d2f38f 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index 5b5772d887..3c89ac5074 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index 044aa0dcc0..16d326bf19 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index e4fe14d829..a3748bbc98 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 16 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 73fc15782a..8eac5deb3f 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index 8b5a15d75b..3655d323d5 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index b235436325..f8527b91ba 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml index c10cf02965..67b4944521 100644 --- a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml +++ b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index 219c3672db..6450260caf 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -51,7 +51,6 @@ tags: - Registry.action - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index edbf26d162..89f0769849 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index cfaf0230e6..75819fcf58 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml index 956f20ea84..c4f8756cad 100644 --- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml @@ -58,7 +58,6 @@ tags: - registry_key_name - registry_key_name_len - registry_value_name_len - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/endpoint/windows_modify_registry_reg_restore.yml index 5e6a9ed246..42166b20cb 100644 --- a/detections/endpoint/windows_modify_registry_reg_restore.yml +++ b/detections/endpoint/windows_modify_registry_reg_restore.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index f9997cd0cb..2d01d09efd 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_risk_behavior.yml b/detections/endpoint/windows_modify_registry_risk_behavior.yml index 41f59e8de0..d23f603a4b 100644 --- a/detections/endpoint/windows_modify_registry_risk_behavior.yml +++ b/detections/endpoint/windows_modify_registry_risk_behavior.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - All_Risk.analyticstories diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index af0c18bb47..88f2211f3d 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index a86d628c3c..e22923391e 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml index 98aa55404b..5f050ea3bf 100644 --- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml +++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml @@ -56,7 +56,6 @@ tags: - Registry.registry_value_data - Registry.process_guid - Registry.action - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml index c586a844df..e6e8315080 100644 --- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml +++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml @@ -50,7 +50,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml index 47ffab75a4..74ae2317fb 100644 --- a/detections/endpoint/windows_modify_registry_usewuserver.yml +++ b/detections/endpoint/windows_modify_registry_usewuserver.yml @@ -41,7 +41,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_utilize_progids.yml b/detections/endpoint/windows_modify_registry_utilize_progids.yml index e59c2ab54f..6c13459ebf 100644 --- a/detections/endpoint/windows_modify_registry_utilize_progids.yml +++ b/detections/endpoint/windows_modify_registry_utilize_progids.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 57f0770928..b350303fe0 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index f6c41c2dc2..1fc7a9678b 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 15ce62d82f..bca2b01f24 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml index a65e07e766..9308bdb542 100644 --- a/detections/endpoint/windows_modify_registry_wuserver.yml +++ b/detections/endpoint/windows_modify_registry_wuserver.yml @@ -41,7 +41,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml index a2607e2686..88f8b15fb1 100644 --- a/detections/endpoint/windows_modify_registry_wustatusserver.yml +++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml @@ -41,7 +41,6 @@ tags: - Registry.registry_value_name - Registry.action - Registry.registry_value_data - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 9beb76498d..f0e1ea1921 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -52,7 +52,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml index e28da4f760..ffe0b056b4 100644 --- a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml +++ b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml @@ -53,7 +53,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 9708180f73..96b27dc3da 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index 0aadd4c361..313c0dbed1 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -37,7 +37,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - Filesystem.file_path diff --git a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml index e57386c614..dc7ebc63a7 100644 --- a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml +++ b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml @@ -49,7 +49,6 @@ tags: - _time - Message - dest - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index f3b4fbd668..82d790f07c 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -54,7 +54,6 @@ tags: - Registry.dest - Registry.registry_value_data - Registry.action - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml index e73e8b7050..61fa3e8b2e 100644 --- a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml +++ b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml @@ -55,7 +55,6 @@ tags: - user - Image - TargetFilename - risk_score: 64 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 68dc424b51..f06459bf85 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml index be28661ec7..d800a27288 100644 --- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml +++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index f4f4d67833..0df84ed3ea 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index 38496af561..3fa23dd9f7 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_msiexec_spawn_windbg.yml b/detections/endpoint/windows_msiexec_spawn_windbg.yml index 7f58eaedca..2a0e652d46 100644 --- a/detections/endpoint/windows_msiexec_spawn_windbg.yml +++ b/detections/endpoint/windows_msiexec_spawn_windbg.yml @@ -55,7 +55,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index ab68d72960..28ec29175c 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml index d905f866d0..93979b17d5 100644 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ b/detections/endpoint/windows_msiexec_with_network_connections.yml @@ -65,7 +65,6 @@ tags: - All_Traffic.dest - All_Traffic.dest_port - All_Traffic.dest_ip - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml index f181dec4bf..f756e4df63 100644 --- a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml +++ b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml @@ -48,7 +48,6 @@ tags: - QueryStatus - ProcessId - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multiple_account_passwords_changed.yml b/detections/endpoint/windows_multiple_account_passwords_changed.yml index 966dcf2443..0725f0115f 100644 --- a/detections/endpoint/windows_multiple_account_passwords_changed.yml +++ b/detections/endpoint/windows_multiple_account_passwords_changed.yml @@ -52,7 +52,6 @@ tags: - TargetDomainName - Logon_ID - user - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multiple_accounts_deleted.yml b/detections/endpoint/windows_multiple_accounts_deleted.yml index 128a70caac..1912a78a0d 100644 --- a/detections/endpoint/windows_multiple_accounts_deleted.yml +++ b/detections/endpoint/windows_multiple_accounts_deleted.yml @@ -52,7 +52,6 @@ tags: - TargetDomainName - Logon_ID - user - risk_score: 18 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multiple_accounts_disabled.yml b/detections/endpoint/windows_multiple_accounts_disabled.yml index 33a0ecb658..0a1b1bb0b5 100644 --- a/detections/endpoint/windows_multiple_accounts_disabled.yml +++ b/detections/endpoint/windows_multiple_accounts_disabled.yml @@ -52,7 +52,6 @@ tags: - TargetDomainName - Logon_ID - user - risk_score: 18 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml index b8a3fb4f82..0a09976e33 100644 --- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml @@ -51,7 +51,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index 5d5d46e86e..77743c3b54 100644 --- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -51,7 +51,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index b953071f12..647fb170c7 100644 --- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -48,7 +48,6 @@ tags: - TargetUserName - Workstation - Status - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml b/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml index bd3b2b6dab..1044ff0777 100644 --- a/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml +++ b/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml @@ -51,7 +51,6 @@ tags: - DomainName - Security - WorkstationName - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 536dd96b2e..d8751ad551 100644 --- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -49,7 +49,6 @@ tags: - Target_User_Name - Caller_User_Name - Computer - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index 885809dda5..37c84e3485 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -48,7 +48,6 @@ tags: - Status - TargetUserName - Workstation - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index 8f3dd04b5f..0435bec6ea 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -52,7 +52,6 @@ tags: - SubjectUserName - TargetUserName - Computer - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index fddcd0c112..77ac17a331 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -53,7 +53,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index 6de41fcf83..ee2caeeada 100644 --- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -50,7 +50,6 @@ tags: - TargetUserName - Computer - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_with_net.yml index 7bfb272d85..1648caaf92 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/endpoint/windows_network_share_interaction_with_net.yml @@ -57,7 +57,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_new_inprocserver32_added.yml b/detections/endpoint/windows_new_inprocserver32_added.yml index 113a1c4a35..46d1dcaf20 100644 --- a/detections/endpoint/windows_new_inprocserver32_added.yml +++ b/detections/endpoint/windows_new_inprocserver32_added.yml @@ -39,7 +39,6 @@ tags: - Registry.dest - Registry.process_guid - Registry.user - risk_score: 2 security_domain: endpoint cve: - CVE-2024-21378 diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 0457c425a3..64e30d67f1 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 50 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index d792dbaad2..6e88bc4ebb 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 128e7e6716..257de4fc78 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml index b1fdbd9389..15408c13d8 100644 --- a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml +++ b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml index e57759a74b..0cad750a0d 100644 --- a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml +++ b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml @@ -49,7 +49,6 @@ tags: - process_id - EventCode - dest - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 12977953b1..ba916222be 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -63,7 +63,6 @@ tags: - SourceProcessId - SourceUser - TargetUser - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index 93ac6480dc..15237d7d27 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 6 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index 96b9cdee1b..4a072bb68a 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 632d2600f5..2332f40a6c 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 7e55ac6d6d..1b194e7251 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -77,7 +77,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index f399ceb9f6..d44fffbed0 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -47,7 +47,6 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.registry_value_data - risk_score: 100 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml index 5e98355977..be303bfda2 100644 --- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml +++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml @@ -54,7 +54,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 90 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index ab77905372..506499ab2a 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 03a3889740..a6107c536f 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 460b042cd3..575566dfd8 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -49,7 +49,6 @@ tags: - process_name - process_path - process - risk_score: 49 security_domain: endpoint cve: - CVE-2024-21378 diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml index f72c1f3832..2c8be45ce0 100644 --- a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml +++ b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index f00bde89c5..9de3c75b60 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -51,7 +51,6 @@ tags: - Registry.registry_value_data - Registry.action - Registry.dest - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index f2b7d275dd..6f0b1d9ced 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -68,7 +68,6 @@ tags: - SourceProcessId - SourceUser - TargetUser - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_post_exploitation_risk_behavior.yml b/detections/endpoint/windows_post_exploitation_risk_behavior.yml index 98594f11a3..03d498348d 100644 --- a/detections/endpoint/windows_post_exploitation_risk_behavior.yml +++ b/detections/endpoint/windows_post_exploitation_risk_behavior.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - All_Risk.analyticstories diff --git a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml index e2535fc9c6..462f495013 100644 --- a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml +++ b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml @@ -47,7 +47,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index 1948eb03b1..0fa9f11c98 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -52,7 +52,6 @@ tags: - Computer - UserID - EventCodes - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index 6fd500380d..931d8e4460 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -52,7 +52,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index cd7f13b1fb..e989086ba0 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -48,7 +48,6 @@ tags: - ScriptBlockText - dest - EventCode - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 097812a84d..80bdd612aa 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -48,7 +48,6 @@ tags: - ScriptBlockText - dest - EventCode - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index 49eeaf50d6..fc8fba71b7 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -45,7 +45,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index b920d8e261..e970b68ab2 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -51,7 +51,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index 46eb025676..ee9f6e3c40 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -52,7 +52,6 @@ tags: - ScriptBlockText - Computer - EventCode - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index d774044048..c963cdbd0f 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index 7df83b4de9..484a751315 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -55,7 +55,6 @@ tags: - Computer - EventCode security_domain: endpoint - risk_score: 25 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml index ea844f9a4b..dc42267c61 100644 --- a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml +++ b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml @@ -47,7 +47,6 @@ tags: - ScriptBlockText - dest - EventCode - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml index f1383fa21d..07d17c3ad2 100644 --- a/detections/endpoint/windows_powersploit_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -57,7 +57,6 @@ tags: - Opcode - Computer - UserID - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml index ba23c518aa..42e7f63546 100644 --- a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml +++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml @@ -52,7 +52,6 @@ tags: - ScriptBlockText - Opcode - UserID - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml index 5550a9d3c3..e4683a8ec6 100644 --- a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml @@ -57,7 +57,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index b3dbd885fc..fdfecae26b 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -51,7 +51,6 @@ tags: - EventCode - Computer - ScriptBlockText - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powerview_spn_discovery.yml b/detections/endpoint/windows_powerview_spn_discovery.yml index 043ec0299b..bfa67f3d98 100644 --- a/detections/endpoint/windows_powerview_spn_discovery.yml +++ b/detections/endpoint/windows_powerview_spn_discovery.yml @@ -51,7 +51,6 @@ tags: - EventCode - Computer - ScriptBlockText - risk_score: 27 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml index cc900f2545..68a2b0a8f4 100644 --- a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml @@ -56,7 +56,6 @@ tags: - ScriptBlockText - Computer - UserID - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 063d0148ce..a013da2925 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml index 5fe5d28c60..5ddf769085 100644 --- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml +++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml @@ -73,7 +73,6 @@ tags: - Processes.process_guid - Processes.process_integrity_level - Processes.process_current_directory - risk_score: 40 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml index 4b1f065ec3..92990b680a 100644 --- a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml +++ b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml @@ -64,7 +64,6 @@ tags: - parent_process_name - parent_process_guid - IntegrityLevel - risk_score: 80 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml index 2cee7919ad..9c7c9ba15d 100644 --- a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml +++ b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml @@ -64,7 +64,6 @@ tags: - parent_process_name - parent_process_guid - IntegrityLevel - risk_score: 80 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml index 481dc3abb7..955620a92c 100644 --- a/detections/endpoint/windows_privileged_group_modification.yml +++ b/detections/endpoint/windows_privileged_group_modification.yml @@ -64,7 +64,6 @@ tags: - result - status - _time - risk_score: 80 security_domain: endpoint cve: - CVE-2024-37085 diff --git a/detections/endpoint/windows_process_commandline_discovery.yml b/detections/endpoint/windows_process_commandline_discovery.yml index 83bdadb474..a1531923d4 100644 --- a/detections/endpoint/windows_process_commandline_discovery.yml +++ b/detections/endpoint/windows_process_commandline_discovery.yml @@ -33,7 +33,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml index 7187177154..c726e6536f 100644 --- a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml +++ b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml index d4f6fbca02..839e149f00 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/endpoint/windows_process_injection_into_notepad.yml @@ -57,7 +57,6 @@ tags: - TargetImage - GrantedAccess - CallTrace - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml index b65afe13cc..f36aef7228 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml @@ -54,7 +54,6 @@ tags: - TargetProcessId - EventCode - dest - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 45c6f64419..4b7ed5a793 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -61,7 +61,6 @@ tags: - TargetProcessGuid - SourceProcessGuid - StartAddress - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index 85e8eec814..2153205594 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index c5ee001ef2..10762ff50b 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -53,7 +53,6 @@ tags: - TargetProcessGuid - SourceProcessGuid - StartAddress - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index beee7b3a2f..e5b501c3db 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -56,7 +56,6 @@ tags: - Processes.process_path - Processes.parent_process_id - Processes.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml index 9dea7b4e6c..6fac7cf083 100644 --- a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml +++ b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml @@ -40,7 +40,6 @@ tags: - user - file_name - file_path - risk_score: 25 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml index 9874d27257..857043048c 100644 --- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -55,7 +55,6 @@ tags: - Processes.process_path - Processes.parent_process_id - Processes.process_guid - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml index eda2dab37e..30fba6ffdc 100644 --- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml +++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 22928e1535..699df0f775 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Processes.process diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index b55bf70c4a..c63ef7931c 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Registry.registry_key_name diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 5d9478153b..2ecbe4cf2e 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -49,7 +49,6 @@ tags: - process_id - EventCode - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/endpoint/windows_query_registry_reg_save.yml index 62d4a5536e..f3cdd5eb25 100644 --- a/detections/endpoint/windows_query_registry_reg_save.yml +++ b/detections/endpoint/windows_query_registry_reg_save.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index fe4505654c..87f511e7bf 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -49,7 +49,6 @@ tags: - process_id - EventCode - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 2b89024f45..54a2e74dc9 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index b2838a4cec..b43edb0b0c 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -54,7 +54,6 @@ tags: - TargetUserName - Computer - IpAddress - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 28fb123129..cd6eee3f7a 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 7f68f0ad60..3d14ab24ed 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -58,7 +58,6 @@ tags: - Device - EventCode - Image - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index ca30f8c558..30b221146e 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -59,7 +59,6 @@ tags: - ProcessId - EventDescription - EventCode - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml index 5822f1ef40..29e3f18ec3 100644 --- a/detections/endpoint/windows_rdp_connection_successful.yml +++ b/detections/endpoint/windows_rdp_connection_successful.yml @@ -40,7 +40,6 @@ tags: - Source_Network_Address - User - Message - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 9092966192..f3b8d22000 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - _time - Registry.dest diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index 3c56c7624c..b08ffa48d7 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -50,7 +50,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml index 0fd237d304..90dd71cc7e 100644 --- a/detections/endpoint/windows_registry_delete_task_sd.yml +++ b/detections/endpoint/windows_registry_delete_task_sd.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.dest - Processes.process_guid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index 5ff5da6618..e3fdd2899e 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -53,7 +53,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml index c7c051015c..dfab993f66 100644 --- a/detections/endpoint/windows_registry_payload_injection.yml +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -71,7 +71,6 @@ tags: - registry_value_name - registry_value_data - registry_key_name - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_sip_provider_modification.yml b/detections/endpoint/windows_registry_sip_provider_modification.yml index 9153e56a8e..3595c99506 100644 --- a/detections/endpoint/windows_registry_sip_provider_modification.yml +++ b/detections/endpoint/windows_registry_sip_provider_modification.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - Registry.dest - Registry.user diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/endpoint/windows_regsvr32_renamed_binary.yml index e50b2995bf..87b37626dc 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/endpoint/windows_regsvr32_renamed_binary.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml index a0a2556455..bb83ab24d1 100644 --- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml +++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml @@ -56,7 +56,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml index a7ae212c36..1daf8813a6 100644 --- a/detections/endpoint/windows_remote_access_software_hunt.yml +++ b/detections/endpoint/windows_remote_access_software_hunt.yml @@ -53,7 +53,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml index 1cec86a666..f80428e3a8 100644 --- a/detections/endpoint/windows_remote_access_software_rms_registry.yml +++ b/detections/endpoint/windows_remote_access_software_rms_registry.yml @@ -50,7 +50,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 03ecfc200d..f04b078277 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -64,7 +64,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 0ee559be20..ff043de43e 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index 8aa68e8b4c..ead314a662 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index 5d1a95ee08..a2b7950c7f 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -53,7 +53,6 @@ tags: - Processes.parent_process_id - Processes.dest - Processes.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index 6f2c01b2d6..f8acf3db8c 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index e5a72f5fab..1d16db3cd0 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -51,7 +51,6 @@ tags: - Registry.dest - Registry.registry_value_name - Registry.action - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 4f615a959e..d8d3569fe8 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -54,7 +54,6 @@ tags: - Filesystem.process_id - Filesystem.file_name - Filesystem.user - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index 49652cb84d..0cad0ab741 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -50,7 +50,6 @@ tags: - ScriptBlockText - Computer - user_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml index adcaa44b75..a0f391b919 100644 --- a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml +++ b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml @@ -57,7 +57,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml index 0afab5a91f..7fdc333980 100644 --- a/detections/endpoint/windows_rundll32_webdav_request.yml +++ b/detections/endpoint/windows_rundll32_webdav_request.yml @@ -73,7 +73,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml index c59dcab6a2..2140021938 100644 --- a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml +++ b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml @@ -64,7 +64,6 @@ tags: - All_Traffic.dest_port - All_Traffic.dest_ip - All_Traffic.dest - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index abf3fca2f4..3cdf1769f9 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -64,7 +64,6 @@ tags: - Processes.user - Processes.process_id - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml index 716ebb75bf..e3e79527be 100644 --- a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml +++ b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml @@ -50,7 +50,6 @@ tags: - EventCode - Signed - ProcessId - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index f7017ddebe..6b99cdff6d 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -63,7 +63,6 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml index 30e8da3e43..6c8af79f47 100644 --- a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml +++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml index 181be4f7dd..0111b8b453 100644 --- a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml +++ b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml @@ -47,7 +47,6 @@ tags: - EventData_Xml - TaskContent - TaskName - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index 76e810865f..7c2be6b736 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -64,7 +64,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index cbdf0d19b7..8543cc558d 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -58,7 +58,6 @@ tags: - Filesystem.file_name - Filesystem.user - Filesystem.file_path - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 73e0e709a8..2ad273fc0c 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -52,7 +52,6 @@ tags: - Computer - UserID - EventCode - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index d54a804801..e4f1e135d4 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -51,7 +51,6 @@ tags: - Processes.process - Processes.dest - Processes.user - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml index 07039e1111..88c5285d5e 100644 --- a/detections/endpoint/windows_security_support_provider_reg_query.yml +++ b/detections/endpoint/windows_security_support_provider_reg_query.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml index 940afc8267..5852fff9eb 100644 --- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml +++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml @@ -71,7 +71,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml index ffeb436072..48bffed592 100644 --- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml +++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 48 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_create_remcomsvc.yml b/detections/endpoint/windows_service_create_remcomsvc.yml index b4a9f7f042..69f86fd569 100644 --- a/detections/endpoint/windows_service_create_remcomsvc.yml +++ b/detections/endpoint/windows_service_create_remcomsvc.yml @@ -49,7 +49,6 @@ tags: - ImagePath - ServiceName - ServiceType - risk_score: 32 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml index 6ada30be0a..745b1232e4 100644 --- a/detections/endpoint/windows_service_create_sliverc2.yml +++ b/detections/endpoint/windows_service_create_sliverc2.yml @@ -49,7 +49,6 @@ tags: - ServiceName - ImagePath - ServiceType - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index faa02298e7..da66a29d6c 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -70,7 +70,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 934a861942..070be95bd1 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -61,7 +61,6 @@ tags: - Service_Name - Service_Start_Type - dest - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 67ba6d45a0..92657f36ec 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -54,7 +54,6 @@ tags: - _time - Service_Name - Service_Start_Type - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 6831b353b4..93ad06f826 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 416aa51004..a81e4733b0 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -55,7 +55,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 95df38040e..4686d76e4b 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_name - Processes.parent_process - Processes.process_guid - risk_score: 18 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 2a1b316fd6..c844d80d6b 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -58,7 +58,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index 0d00fde6cb..99929e3490 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -55,7 +55,6 @@ tags: - Processes.parent_process_id - Processes.dest - Processes.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml index a610acb064..0cf7efb2cc 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml index 76110d8b19..048c75078f 100644 --- a/detections/endpoint/windows_service_stop_win_updates.yml +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -52,7 +52,6 @@ tags: - param2 - param3 - param4 - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_sip_provider_inventory.yml b/detections/endpoint/windows_sip_provider_inventory.yml index 88203d9c78..eb499de108 100644 --- a/detections/endpoint/windows_sip_provider_inventory.yml +++ b/detections/endpoint/windows_sip_provider_inventory.yml @@ -31,7 +31,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - Path - Dll diff --git a/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml index 59bfe6f7dc..5d75a3dfa4 100644 --- a/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml +++ b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Computer diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index ce611929aa..cc3baf7716 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Filesystem.file_create_time diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index f82922c957..58fc3c3cdf 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 56 required_fields: - _time - Filesystem.file_create_time diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index a318f03a78..57c693a60b 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Registry.dest diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index 2bbf8e3e0d..68321509d8 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - EventCode - Service_File_Name diff --git a/detections/endpoint/windows_soaphound_binary_execution.yml b/detections/endpoint/windows_soaphound_binary_execution.yml index 9c36f14fce..0a12176589 100644 --- a/detections/endpoint/windows_soaphound_binary_execution.yml +++ b/detections/endpoint/windows_soaphound_binary_execution.yml @@ -53,7 +53,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 80 required_fields: - Processes.process - Processes.dest diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml index 9ecf20bffb..d4ba56440f 100644 --- a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml +++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml @@ -41,7 +41,6 @@ tags: - QueryResults - QueryStatus - dest - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml index 93ba514357..7d75ef3616 100644 --- a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml +++ b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml @@ -62,7 +62,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml index 8d9bd03fd2..873ff4f057 100644 --- a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml +++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml @@ -52,7 +52,6 @@ tags: - Caller_User_Name - Computer - PrivilegeList - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index ce2594020a..790a24f65c 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 90 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml index 8f4b00bc19..ca6ff11238 100644 --- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml +++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml @@ -55,7 +55,6 @@ tags: - user - Computer - EventCode - risk_score: 64 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml index 99252680f7..e95e8b3dd2 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml @@ -58,7 +58,6 @@ tags: - EventCode - Requester - RequestId - risk_score: 60 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml index 8adf070e45..73620ee496 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml @@ -74,7 +74,6 @@ tags: - TargetUserName - Computer - IpAddress - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml index a4360ac56e..1f79b6c989 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml @@ -47,7 +47,6 @@ tags: - Requester - action - Attributes - risk_score: 8 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml index 189ba19231..dcf19034a5 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml @@ -47,7 +47,6 @@ tags: - Requester - action - Attributes - risk_score: 8 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml index d1c21690df..177e011981 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml @@ -67,7 +67,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index f9f54089c2..114ad957cf 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -44,7 +44,6 @@ tags: - _time - Computer - UserData_Xml - risk_score: 24 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml index 4de9440ec6..49a23adbf3 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml @@ -47,7 +47,6 @@ tags: - action - Caller_Domain - Caller_User_Name - risk_score: 40 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index e8c0655a70..8de248cd9a 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index d052fdc760..0795e733b6 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml index 36edb55c16..1f053e57b4 100644 --- a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml +++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml @@ -50,7 +50,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index cbf3b5539a..e7fd793f15 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -65,7 +65,6 @@ tags: - All_Traffic.dest - All_Traffic.dest_ip - All_Traffic.dest_port - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 97c5acf55a..d18dec8e45 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -68,7 +68,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml index bbc7a524b2..a0c0c4b71a 100644 --- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_discovery_using_qwinsta.yml b/detections/endpoint/windows_system_discovery_using_qwinsta.yml index 1b680dd7f2..6413006797 100644 --- a/detections/endpoint/windows_system_discovery_using_qwinsta.yml +++ b/detections/endpoint/windows_system_discovery_using_qwinsta.yml @@ -47,7 +47,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index 5208b98aba..f0c4e548d1 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -43,7 +43,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 10 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f87ed554a7..6f0bcf9a7f 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index 6d03253ec1..8933892a54 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index a299267b23..2053e6d64e 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -61,7 +61,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 875b57a13d..24ae8747a4 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 4631f15c22..fac1ec545a 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 3a5a4d3c45..d1d5907851 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -60,7 +60,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index eb3ffe0ab1..43303d603c 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index acac29b5ee..789a90bac7 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -51,7 +51,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_user_privilege_discovery.yml b/detections/endpoint/windows_system_user_privilege_discovery.yml index b2bd517595..99b9cb2a8d 100644 --- a/detections/endpoint/windows_system_user_privilege_discovery.yml +++ b/detections/endpoint/windows_system_user_privilege_discovery.yml @@ -34,7 +34,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 15 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index 985833bc3c..6af3c5ceac 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -56,7 +56,6 @@ tags: - SourceImage - SourceProcessId - GrantedAccess - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index b679af1524..6e056b8410 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 36 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml index cf6fb82dc2..40d2f15307 100644 --- a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml +++ b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - _time - Processes.dest diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml index 08783d9e3e..2d66622862 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml @@ -65,7 +65,6 @@ tags: - Processes.process_path - Processes.process_integrity_level - Processes.process_current_directory - risk_score: 45 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml index 6777f8dca2..e04c46cb1d 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml @@ -73,7 +73,6 @@ tags: - Processes.process_path - Processes.process_integrity_level - Processes.process_current_directory - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index caf0e14513..1836d6b9d1 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - object_file_name diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 6b38ae9e49..1ad7e29669 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -42,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Image diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index ae2fd31a3a..3492cc6655 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 required_fields: - _time - Image diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index ef503de497..24178366a6 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -56,7 +56,6 @@ tags: - user - Computer - EventCode - risk_score: 9 security_domain: endpoint cve: [] tests: diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml index 4bcefdccce..f9acde8a4e 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml @@ -51,7 +51,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index 69985257ed..735bb3ab5e 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -51,7 +51,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index 0857438d35..f72e63dc19 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -52,7 +52,6 @@ tags: - TargetUserName - Workstation - Status - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index c2668a46de..3d78bfcd11 100644 --- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -53,7 +53,6 @@ tags: - Target_User_Name - Caller_User_Name - Computer - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index 5d29cbb5e7..55056c168e 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -53,7 +53,6 @@ tags: - Status - TargetUserName - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml index 72c00ef104..3aefd721cd 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -56,7 +56,6 @@ tags: - SubjectUserName - TargetUserName - Computer - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml index fb23accc7a..a10e729c58 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -48,7 +48,6 @@ tags: - Status - TargetUserName - Workstation - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml index 0dd4119bf6..a976e61e7b 100644 --- a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -50,7 +50,6 @@ tags: - TargetUserName - Computer - IpAddress - risk_score: 49 security_domain: endpoint tests: - attack_data: diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml index 32bdd62fbf..f781cfa51a 100644 --- a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml +++ b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml @@ -51,7 +51,6 @@ tags: - DomainName - Security - WorkstationName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml index a15464ddbf..97749e43ef 100644 --- a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml +++ b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml @@ -51,7 +51,6 @@ tags: - DomainName - Security - WorkstationName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml index b1451a2b5a..9b4f74b0f6 100644 --- a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml +++ b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml @@ -51,7 +51,6 @@ tags: - DomainName - Security - WorkstationName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml index ba01c79bac..a87788f6cd 100644 --- a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml +++ b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml @@ -51,7 +51,6 @@ tags: - DomainName - Security - WorkstationName - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 1c25e72a0f..3f96e889a6 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -57,7 +57,6 @@ tags: - Filesystem.file_path - Filesystem.process_guid - Filesystem.dest - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml index 3ea471af12..206d8c3991 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index b5cd4abb4f..e9c4ec0dea 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -60,7 +60,6 @@ tags: - CommandLine - dest - parent_process_name - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index d42e1eb3af..5be9dcd4e4 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -44,7 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 50 required_fields: - ServiceType - driver_name diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index b34dfc2652..bd971b10a8 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -48,7 +48,6 @@ tags: - _time - dest - ImageLoaded - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_windbg_spawning_autoit3.yml b/detections/endpoint/windows_windbg_spawning_autoit3.yml index 83adefe441..211d06d05c 100644 --- a/detections/endpoint/windows_windbg_spawning_autoit3.yml +++ b/detections/endpoint/windows_windbg_spawning_autoit3.yml @@ -55,7 +55,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index f1109ffc2b..cb0be4c657 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -32,7 +32,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 25 required_fields: - dest - parent_process_name diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 14270d689d..57ca08bd8f 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -52,7 +52,6 @@ tags: - GrantedAccess - CallTrace - dest - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_wmi_process_and_service_list.yml b/detections/endpoint/windows_wmi_process_and_service_list.yml index 425b511c0a..d080f61a91 100644 --- a/detections/endpoint/windows_wmi_process_and_service_list.yml +++ b/detections/endpoint/windows_wmi_process_and_service_list.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_id - Processes.parent_process_guid - Processes.process_guid - risk_score: 4 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index c9ade54a7d..5a5b2345be 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -58,7 +58,6 @@ tags: - Processes.process_path - Processes.parent_process_id - Processes.process_guid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 60833be2c5..bfb5cef2bf 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -57,7 +57,6 @@ tags: - Task_Name - Description - Command - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 4e202ce6ca..7b11c73721 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -64,7 +64,6 @@ tags: - Task_Name - Description - Command - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a9312e619e..e18e7ee260 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -62,7 +62,6 @@ tags: - EventID - dvc - ProcessID - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 6300eba526..a206d497a7 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml index f47d50d9a9..8c7e914bfb 100644 --- a/detections/endpoint/winrar_spawning_shell_application.yml +++ b/detections/endpoint/winrar_spawning_shell_application.yml @@ -59,7 +59,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 70 required_fields: - Processes.dest - Processes.user diff --git a/detections/endpoint/winrm_spawning_a_process.yml b/detections/endpoint/winrm_spawning_a_process.yml index 82df49e04d..ef8210be31 100644 --- a/detections/endpoint/winrm_spawning_a_process.yml +++ b/detections/endpoint/winrm_spawning_a_process.yml @@ -52,5 +52,4 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 43c6696a9f..12e85f6f67 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -66,7 +66,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 124ede8d74..c5c996c060 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 1e0bc7ce65..c5988dfb9e 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -60,7 +60,6 @@ tags: - dest - user - parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index f33ec6f8d9..88e8622ba8 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -35,5 +35,4 @@ tags: - Message - consumer - ComputerName - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 740a35c3a2..f5c1e17a75 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -58,7 +58,6 @@ tags: - Query - Consumer - Filter - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index b9fff187de..18db7cdfe4 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -56,7 +56,6 @@ tags: - Computer - UserID - EventCode - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index c37ca459ca..1e87856130 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -34,5 +34,4 @@ tags: - EventCode - Message - query - risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index cc0bb3c0e5..e0c1d31d97 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -52,7 +52,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index 0b2b1c10ee..c115a0de90 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -56,7 +56,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 8f4b97138a..75ed576e51 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml index 18395735e0..16d2e0e9dd 100644 --- a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml @@ -57,7 +57,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 2aa6b6a3e3..3ef3f3d14c 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -69,7 +69,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml index 1238513d07..f1c96ce5f6 100644 --- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml @@ -59,7 +59,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 54 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 67b3d9c1ef..79eeaa02fa 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -63,7 +63,6 @@ tags: - Registry.registry_path - Registry.registry_value_data - Registry.process_guid - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 29ed54a869..d22025707b 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -50,7 +50,6 @@ tags: - IMPHASH - Signature - Signed - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index c616cfa960..397d3758c9 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -67,7 +67,6 @@ tags: - Processes.process - Processes.dest - Processes.user - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 4273b605a3..2ac251305e 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -41,5 +41,4 @@ tags: - src_int_suffix - host - src_interface - risk_score: 25 security_domain: network diff --git a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml index 4ea1f1f9c7..a76ea13f78 100644 --- a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml @@ -62,5 +62,4 @@ tags: - domain - firstTime - lastTime - risk_score: 63 security_domain: network diff --git a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml index e5a6b2fd24..55007f009a 100644 --- a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml @@ -45,5 +45,4 @@ tags: - DNS.src - DNS.dest - DNS.answer - risk_score: 45 security_domain: network diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 15626d03da..d9c7108ec2 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -59,7 +59,6 @@ tags: - DNS.answer - DNS.query - host - risk_score: 56 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml index 139bd9c2f3..3a68602aa0 100644 --- a/detections/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -52,5 +52,4 @@ tags: - src_vlan - vendor_explanation - action - risk_score: 25 security_domain: network diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 99ee9f52b5..299d419d93 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -74,7 +74,6 @@ tags: - All_Traffic.transport - All_Traffic.src_ip - All_Traffic.dest_ip - risk_score: 25 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 44b24ed199..558d5c82f4 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -43,7 +43,6 @@ tags: - All_Traffic.dest_ip - All_Traffic.dest_port - All_Traffic.src_ip - risk_score: 56 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 8917f723bc..f00132715b 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -58,7 +58,6 @@ tags: - sourcetype - All_Traffic.src_ip - All_Traffic.direction - risk_score: 25 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml index e131336825..a9b044301a 100644 --- a/detections/network/detect_port_security_violation.yml +++ b/detections/network/detect_port_security_violation.yml @@ -44,5 +44,4 @@ tags: - action - host - src_interface - risk_score: 25 security_domain: network diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 5026122208..1e59812ab2 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -54,7 +54,6 @@ tags: - DNS.src - DNS.query - DNS.answer - risk_score: 4 security_domain: endpoint manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 032d96a64a..6bc0d2a403 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -52,7 +52,6 @@ tags: - All_Traffic.app - All_Traffic.dest_port - user - risk_score: 25 security_domain: network manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml index c147af50ac..bf38de070c 100644 --- a/detections/network/detect_rogue_dhcp_server.yml +++ b/detections/network/detect_rogue_dhcp_server.yml @@ -38,5 +38,4 @@ tags: - message_type - src_mac - host - risk_score: 25 security_domain: network diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/network/detect_snicat_sni_exfiltration.yml index c9ccd011f4..81040b8b2e 100644 --- a/detections/network/detect_snicat_sni_exfiltration.yml +++ b/detections/network/detect_snicat_sni_exfiltration.yml @@ -37,5 +37,4 @@ tags: - server_name - src_ip - dest_ip - risk_score: 25 security_domain: network diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml index 48bdda0511..0a6bdd40a2 100644 --- a/detections/network/detect_software_download_to_network_device.yml +++ b/detections/network/detect_software_download_to_network_device.yml @@ -38,5 +38,4 @@ tags: - All_Traffic.src_category - All_Traffic.src - All_Traffic.dest - risk_score: 25 security_domain: network diff --git a/detections/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml b/detections/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml index f10c2c5a70..4db3c98ee7 100644 --- a/detections/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml @@ -63,5 +63,4 @@ tags: - DNS.src - DNS.dest - DNS.answer - risk_score: 45 security_domain: network diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index fb4ac5bf17..b7a49244e7 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -37,5 +37,4 @@ tags: - facility - mnemonic - host - risk_score: 25 security_domain: network diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml index 7ca657267b..0dc6c450cc 100644 --- a/detections/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/network/detect_unauthorized_assets_by_mac_address.yml @@ -32,5 +32,4 @@ tags: - All_Sessions.signature - All_Sessions.src_ip - All_Sessions.dest_mac - risk_score: 25 security_domain: network diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 589e454499..9579a46b02 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -33,5 +33,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: network diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index 8349550848..6de3225e38 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -37,5 +37,4 @@ tags: - DNS.flow_id - All_Traffic.bytes_in - All_Traffic.flow_id - risk_score: 25 security_domain: endpoint diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index 732d12911e..28915436cd 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -39,5 +39,4 @@ tags: required_fields: - _time - operation - risk_score: 25 security_domain: network diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml index 6746816a73..de6fe0efed 100644 --- a/detections/network/dns_query_length_outliers___mltk.yml +++ b/detections/network/dns_query_length_outliers___mltk.yml @@ -38,5 +38,4 @@ tags: - DNS.dest - DNS.query - DNS.record_type - risk_score: 25 security_domain: network diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index aaa29461f3..b3243a4d7e 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -45,7 +45,6 @@ tags: required_fields: - _time - DNS.query - risk_score: 56 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml index 82dda35400..2231c1d667 100644 --- a/detections/network/excessive_dns_failures.yml +++ b/detections/network/excessive_dns_failures.yml @@ -36,5 +36,4 @@ tags: - DNS.query - DNS.reply_code - DNS.src - risk_score: 25 security_domain: network diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml index 2f16c40068..0d87386d84 100644 --- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml +++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml @@ -55,7 +55,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 70 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index b130bf67ff..4ea1599681 100644 --- a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -35,5 +35,4 @@ tags: - All_Traffic.bytes_in - All_Traffic.dest_category - All_Traffic.src_ip - risk_score: 25 security_domain: network diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml index 413608fe6a..9062d1404b 100644 --- a/detections/network/internal_horizontal_port_scan.yml +++ b/detections/network/internal_horizontal_port_scan.yml @@ -39,7 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - All_Traffic.action diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 816b6d3af9..7702a86405 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -56,7 +56,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - _time - All_Traffic.action diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml index 3198a824b2..a2f3ed55cb 100644 --- a/detections/network/internal_vertical_port_scan.yml +++ b/detections/network/internal_vertical_port_scan.yml @@ -39,7 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - All_Traffic.action diff --git a/detections/network/internal_vulnerability_scan.yml b/detections/network/internal_vulnerability_scan.yml index b154e2a680..0d1b22e11f 100644 --- a/detections/network/internal_vulnerability_scan.yml +++ b/detections/network/internal_vulnerability_scan.yml @@ -30,7 +30,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - IDS_Attacks.action diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml index 45393b2161..0987145b7e 100644 --- a/detections/network/large_volume_of_dns_any_queries.yml +++ b/detections/network/large_volume_of_dns_any_queries.yml @@ -35,5 +35,4 @@ tags: - DNS.message_type - DNS.record_type - DNS.dest - risk_score: 25 security_domain: network diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml index d978609d71..05f0337536 100644 --- a/detections/network/ngrok_reverse_proxy_on_network.yml +++ b/detections/network/ngrok_reverse_proxy_on_network.yml @@ -48,7 +48,6 @@ tags: - DNS.src - DNS.query - DNS.answer - risk_score: 50 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index e3caba6ac3..33b0f6c923 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -50,7 +50,6 @@ tags: - All_Traffic.src_ip - All_Traffic.dest_ip - All_Traffic.dest_port - risk_score: 25 security_domain: network manual_test: This detection uses builtin lookup from Enterprise Security. tests: diff --git a/detections/network/protocol_or_port_mismatch.yml b/detections/network/protocol_or_port_mismatch.yml index c9c993d2b3..32e6f8f864 100644 --- a/detections/network/protocol_or_port_mismatch.yml +++ b/detections/network/protocol_or_port_mismatch.yml @@ -37,5 +37,4 @@ tags: - All_Traffic.dest_port - All_Traffic.src_ip - All_Traffic.dest_ip - risk_score: 25 security_domain: network diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml index 2c96157842..bd53c550d9 100644 --- a/detections/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/network/protocols_passing_authentication_in_cleartext.yml @@ -41,5 +41,4 @@ tags: - All_Traffic.src - All_Traffic.dest - All_Traffic.action - risk_score: 25 security_domain: network diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 2634f6b9cf..5ccb854f1c 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -49,5 +49,4 @@ tags: - All_Traffic.src - All_Traffic.dest - All_Traffic.dest_port - risk_score: 25 security_domain: network diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index 0fdb8716b0..6ebbd6ddde 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -54,7 +54,6 @@ tags: - All_Traffic.src - All_Traffic.dest - All_Traffic.dest_port - risk_score: 25 security_domain: network manual_test: This detection uses builtin lookup from Enterprise Security. tests: diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index 6240cd584a..011d17e6e7 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -38,5 +38,4 @@ tags: - All_Traffic.dest_port - All_Traffic.app - All_Traffic.src - risk_score: 25 security_domain: network diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml index 8500e94944..62b5045a6f 100644 --- a/detections/network/smb_traffic_spike___mltk.yml +++ b/detections/network/smb_traffic_spike___mltk.yml @@ -45,5 +45,4 @@ tags: - All_Traffic.dest_port - All_Traffic.app - All_Traffic.src - risk_score: 25 security_domain: network diff --git a/detections/network/ssl_certificates_with_punycode.yml b/detections/network/ssl_certificates_with_punycode.yml index 89c12e2ed3..dd186d98f1 100644 --- a/detections/network/ssl_certificates_with_punycode.yml +++ b/detections/network/ssl_certificates_with_punycode.yml @@ -41,5 +41,4 @@ tags: - All_Certificates.SSL.src - All_Certificates.SSL.sourcetype - All_Certificates.SSL.ssl_subject_email_domain - risk_score: 15 security_domain: network diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index c755e011b2..0801b937a8 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -52,7 +52,6 @@ tags: - All_Traffic.src_ip - All_Traffic.dest_ip - All_Traffic.dest_port - risk_score: 80 security_domain: network tests: - name: True Positive Test diff --git a/detections/network/windows_ad_replication_service_traffic.yml b/detections/network/windows_ad_replication_service_traffic.yml index 60ebda269e..8956ea9fd3 100644 --- a/detections/network/windows_ad_replication_service_traffic.yml +++ b/detections/network/windows_ad_replication_service_traffic.yml @@ -42,5 +42,4 @@ tags: - All_Traffic.src - All_Traffic.dest - All_Traffic.app - risk_score: 100 security_domain: network diff --git a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml index 440d5240a1..fc5ca3a15a 100644 --- a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml +++ b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml @@ -38,5 +38,4 @@ tags: - _time - src - dest - risk_score: 100 security_domain: network diff --git a/detections/network/zeek_x509_certificate_with_punycode.yml b/detections/network/zeek_x509_certificate_with_punycode.yml index 6e781a5f27..ae96e370b2 100644 --- a/detections/network/zeek_x509_certificate_with_punycode.yml +++ b/detections/network/zeek_x509_certificate_with_punycode.yml @@ -40,5 +40,4 @@ tags: - basic_constraints.ca - source - host - risk_score: 15 security_domain: network diff --git a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml index e037a0f524..4140d25c54 100644 --- a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml +++ b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - Web.src - Web.dest diff --git a/detections/web/adobe_coldfusion_access_control_bypass.yml b/detections/web/adobe_coldfusion_access_control_bypass.yml index 1505341e33..b05561955f 100644 --- a/detections/web/adobe_coldfusion_access_control_bypass.yml +++ b/detections/web/adobe_coldfusion_access_control_bypass.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Web.http_method diff --git a/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml b/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml index 350e5ad03e..8db1dfed1e 100644 --- a/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml +++ b/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Web.http_method diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml index a6875a7e59..0b5d1d4189 100644 --- a/detections/web/cisco_ios_xe_implant_access.yml +++ b/detections/web/cisco_ios_xe_implant_access.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - _time - Web.http_method diff --git a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml index 458dfc00a1..fa23116008 100644 --- a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml +++ b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 90 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index cf0903a163..5308ee63ed 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -38,7 +38,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Web.http_method diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml index 6757ed3488..002ba3e6b0 100644 --- a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml +++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml @@ -34,7 +34,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Web.http_method diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml index 83031961a7..8c53699d83 100644 --- a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml +++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - _time - Web.http_method diff --git a/detections/web/confluence_data_center_and_server_privilege_escalation.yml b/detections/web/confluence_data_center_and_server_privilege_escalation.yml index 50aa9ffeff..eeef10aa21 100644 --- a/detections/web/confluence_data_center_and_server_privilege_escalation.yml +++ b/detections/web/confluence_data_center_and_server_privilege_escalation.yml @@ -51,7 +51,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - _time - Web.http_method diff --git a/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml b/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml index 48465131a3..e337feaab0 100644 --- a/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml +++ b/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - Web.src - Web.dest diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index a52d29344d..409e680fa7 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -60,7 +60,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 100 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/connectwise_screenconnect_authentication_bypass.yml b/detections/web/connectwise_screenconnect_authentication_bypass.yml index 86c4aa0f06..936d9a08af 100644 --- a/detections/web/connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/connectwise_screenconnect_authentication_bypass.yml @@ -49,7 +49,6 @@ tags: - Web.url - Web.status - Web.http_method - risk_score: 100 security_domain: network cve: - CVE-2024-1708 diff --git a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml index 698d5999fe..381d4edf33 100644 --- a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml +++ b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml @@ -37,5 +37,4 @@ tags: - Web.url - Web.src - Web.dest - risk_score: 25 security_domain: network diff --git a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml index 12411042b2..1ece9d6aa5 100644 --- a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml @@ -35,5 +35,4 @@ tags: - Splunk Cloud required_fields: - _time - risk_score: 25 security_domain: network diff --git a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml index cfdf6e52a6..07b8f1f3b0 100644 --- a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml +++ b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml @@ -35,5 +35,4 @@ tags: - Web.url_length - Web.src - Web.dest - risk_score: 25 security_domain: network diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 6cb8d99dfd..9022f25782 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -59,7 +59,6 @@ tags: - Web.src - Web.category - Web.url_domain - risk_score: 25 security_domain: network manual_test: This detection uses A&I lookups from Enterprise Security. tests: diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml index 4248e7a77f..5e1aec50aa 100644 --- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml +++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml @@ -63,7 +63,6 @@ tags: - Web.status - Web.uri_query - Web.uri_path - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml index 9be6407d0a..30f3776995 100644 --- a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml +++ b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml @@ -53,7 +53,6 @@ tags: - Web.src - Web.dest - sourcetype - risk_score: 64 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/f5_tmui_authentication_bypass.yml b/detections/web/f5_tmui_authentication_bypass.yml index 4043d71792..97c467e59b 100644 --- a/detections/web/f5_tmui_authentication_bypass.yml +++ b/detections/web/f5_tmui_authentication_bypass.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 90 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml index 1a65dc6f2e..a131eb1bba 100644 --- a/detections/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -56,7 +56,6 @@ tags: - Web.src - Web.dest - sourcetype - risk_score: 81 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/high_volume_of_bytes_out_to_url.yml b/detections/web/high_volume_of_bytes_out_to_url.yml index 57c17acdbb..7cd735eb49 100644 --- a/detections/web/high_volume_of_bytes_out_to_url.yml +++ b/detections/web/high_volume_of_bytes_out_to_url.yml @@ -54,7 +54,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 9 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/hunting_for_log4shell.yml b/detections/web/hunting_for_log4shell.yml index f88aa46263..12cde1629b 100644 --- a/detections/web/hunting_for_log4shell.yml +++ b/detections/web/hunting_for_log4shell.yml @@ -48,7 +48,6 @@ tags: required_fields: - _time - _raw - risk_score: 40 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/ivanti_connect_secure_command_injection_attempts.yml b/detections/web/ivanti_connect_secure_command_injection_attempts.yml index 8ee52267fe..1ca016f75b 100644 --- a/detections/web/ivanti_connect_secure_command_injection_attempts.yml +++ b/detections/web/ivanti_connect_secure_command_injection_attempts.yml @@ -50,7 +50,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 90 required_fields: - Web.src - Web.dest diff --git a/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml b/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml index fea7dd1e5a..625a98f383 100644 --- a/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml +++ b/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - Web.src - Web.dest diff --git a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml index b1ebe01e67..059c005bbe 100644 --- a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml +++ b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - Web.src - Web.dest diff --git a/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml b/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml index b169b8f64d..af9be5b8f9 100644 --- a/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml +++ b/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml @@ -51,7 +51,6 @@ tags: - Web.src - Web.dest - sourcetype - risk_score: 80 security_domain: network cve: - CVE-2024-29824 diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml index 3ee8811f44..416f12e8cd 100644 --- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Web.http_method diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml index 0b625239ee..782a025e21 100644 --- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 64 required_fields: - _time - Web.http_method diff --git a/detections/web/ivanti_sentry_authentication_bypass.yml b/detections/web/ivanti_sentry_authentication_bypass.yml index aeb8b3bac2..9ebcb8b9e1 100644 --- a/detections/web/ivanti_sentry_authentication_bypass.yml +++ b/detections/web/ivanti_sentry_authentication_bypass.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/java_class_file_download_by_java_user_agent.yml b/detections/web/java_class_file_download_by_java_user_agent.yml index 1c3ba6d4c6..d4ee8b6561 100644 --- a/detections/web/java_class_file_download_by_java_user_agent.yml +++ b/detections/web/java_class_file_download_by_java_user_agent.yml @@ -60,7 +60,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 40 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml b/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml index 679b22107d..880fe3fe9c 100644 --- a/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml +++ b/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml @@ -53,7 +53,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - Web.src - Web.dest diff --git a/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml b/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml index 796be2da3e..975e1ff580 100644 --- a/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml +++ b/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml @@ -57,7 +57,6 @@ tags: - Web.http_method - sourcetype - source - risk_score: 81 security_domain: network cve: - CVE-2024-27198 diff --git a/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml b/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml index cb2b785167..379ee36fb1 100644 --- a/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml +++ b/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml @@ -54,7 +54,6 @@ tags: - http.url - http.status - http_method - risk_score: 81 security_domain: network cve: - CVE-2024-27198 diff --git a/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml b/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml index 094ff34444..1c51d2876d 100644 --- a/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml +++ b/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml @@ -54,7 +54,6 @@ tags: - http.url - http.status - http_method - risk_score: 63 security_domain: network cve: - CVE-2024-27199 diff --git a/detections/web/jetbrains_teamcity_rce_attempt.yml b/detections/web/jetbrains_teamcity_rce_attempt.yml index 0b5bce816f..05e5eb3741 100644 --- a/detections/web/jetbrains_teamcity_rce_attempt.yml +++ b/detections/web/jetbrains_teamcity_rce_attempt.yml @@ -52,7 +52,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml index afdb073b1f..9aa7637609 100644 --- a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml +++ b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml @@ -57,7 +57,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index 5cec66ffc9..d9e077848e 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -63,7 +63,6 @@ tags: - url - url_domain - user - risk_score: 15 security_domain: threat tests: - name: True Positive Test diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index ea36371aff..39709bbe05 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -61,7 +61,6 @@ tags: - url - url_domain - user - risk_score: 15 security_domain: threat tests: - name: True Positive Test diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml index 05f63dac19..20c134c316 100644 --- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml +++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml @@ -48,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 45 required_fields: - _time - Web.http_method diff --git a/detections/web/monitor_web_traffic_for_brand_abuse.yml b/detections/web/monitor_web_traffic_for_brand_abuse.yml index 76576b90d2..a8b891a97a 100644 --- a/detections/web/monitor_web_traffic_for_brand_abuse.yml +++ b/detections/web/monitor_web_traffic_for_brand_abuse.yml @@ -31,5 +31,4 @@ tags: - _time - Web.url - Web.src - risk_score: 25 security_domain: network diff --git a/detections/web/multiple_archive_files_http_post_traffic.yml b/detections/web/multiple_archive_files_http_post_traffic.yml index 1b33d2eb8c..2533ef967c 100644 --- a/detections/web/multiple_archive_files_http_post_traffic.yml +++ b/detections/web/multiple_archive_files_http_post_traffic.yml @@ -59,7 +59,6 @@ tags: - archive_hdr1 - archive_hdr2 - form_data - risk_score: 25 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml index 138580f5a6..613124ed19 100644 --- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml @@ -55,7 +55,6 @@ tags: - http_method - sourcetype - source - risk_score: 100 security_domain: network cve: - CVE-2024-1708 diff --git a/detections/web/papercut_ng_remote_web_access_attempt.yml b/detections/web/papercut_ng_remote_web_access_attempt.yml index 1be5f5b538..444473a694 100644 --- a/detections/web/papercut_ng_remote_web_access_attempt.yml +++ b/detections/web/papercut_ng_remote_web_access_attempt.yml @@ -46,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 63 required_fields: - _time - Web.http_user_agent diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml index 96955b1d68..f72015cc5a 100644 --- a/detections/web/plain_http_post_exfiltrated_data.yml +++ b/detections/web/plain_http_post_exfiltrated_data.yml @@ -50,7 +50,6 @@ tags: - url - bytes_in - bytes_out - risk_score: 63 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/proxyshell_proxynotshell_behavior_detected.yml b/detections/web/proxyshell_proxynotshell_behavior_detected.yml index 3b8628a558..a9b1951539 100644 --- a/detections/web/proxyshell_proxynotshell_behavior_detected.yml +++ b/detections/web/proxyshell_proxynotshell_behavior_detected.yml @@ -49,7 +49,6 @@ tags: - All_Risk.risk_object - All_Risk.annotations.mitre_attack.mitre_tactic - source - risk_score: 81 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml index cf5c4727c9..cc3d8d3bd1 100644 --- a/detections/web/spring4shell_payload_url_request.yml +++ b/detections/web/spring4shell_payload_url_request.yml @@ -59,7 +59,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 36 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index 0e6a678a17..767904ba41 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -38,5 +38,4 @@ tags: - Web.dest - Web.url - Web.http_user_agent - risk_score: 25 security_domain: network diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml index f34d8d78d0..f4b693cf30 100644 --- a/detections/web/supernova_webshell.yml +++ b/detections/web/supernova_webshell.yml @@ -44,5 +44,4 @@ tags: - Web.vendor_product - Web.user - Web.http_user_agent - risk_score: 25 security_domain: network diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml index 3126377481..bfb251a46b 100644 --- a/detections/web/unusually_long_content_type_length.yml +++ b/detections/web/unusually_long_content_type_length.yml @@ -49,5 +49,4 @@ tags: - src_ip - dest_ip - url - risk_score: 25 security_domain: network diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml index bb480129bf..3164ffceec 100644 --- a/detections/web/vmware_aria_operations_exploit_attempt.yml +++ b/detections/web/vmware_aria_operations_exploit_attempt.yml @@ -53,7 +53,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - Web.http_method - Web.url diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index ee28a5064c..c1c61dcf68 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -46,7 +46,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 35 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml index 6d6fb40a85..5bebc8cc95 100644 --- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -54,7 +54,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 49 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml index a3c9bc4884..2a85b005a1 100644 --- a/detections/web/web_jsp_request_via_url.yml +++ b/detections/web/web_jsp_request_via_url.yml @@ -59,7 +59,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/web_remote_shellservlet_access.yml b/detections/web/web_remote_shellservlet_access.yml index 8039eb3209..300a723b01 100644 --- a/detections/web/web_remote_shellservlet_access.yml +++ b/detections/web/web_remote_shellservlet_access.yml @@ -45,7 +45,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 81 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml index 321632df47..50c2c55ef2 100644 --- a/detections/web/web_spring4shell_http_request_class_module.yml +++ b/detections/web/web_spring4shell_http_request_class_module.yml @@ -56,7 +56,6 @@ tags: - url - bytes_in - bytes_out - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml index 6e9cfecf7a..1ea2a671cf 100644 --- a/detections/web/web_spring_cloud_function_functionrouter.yml +++ b/detections/web/web_spring_cloud_function_functionrouter.yml @@ -56,7 +56,6 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 42 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml index 233ca0702a..b272ded01e 100644 --- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml +++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml @@ -65,7 +65,6 @@ tags: - Web.dest - Web.http_method - Web.uri_query - risk_score: 72 security_domain: network tests: - name: True Positive Test diff --git a/detections/web/windows_iis_server_pswa_console_access.yml b/detections/web/windows_iis_server_pswa_console_access.yml index c0c923ad6c..049a760fee 100644 --- a/detections/web/windows_iis_server_pswa_console_access.yml +++ b/detections/web/windows_iis_server_pswa_console_access.yml @@ -43,7 +43,6 @@ tags: - Web.dest - Web.http_method - Web.uri_query - risk_score: 32 security_domain: network cve: [] tests: diff --git a/detections/web/wordpress_bricks_builder_plugin_rce.yml b/detections/web/wordpress_bricks_builder_plugin_rce.yml index 2afbb474b9..dc09d50d34 100644 --- a/detections/web/wordpress_bricks_builder_plugin_rce.yml +++ b/detections/web/wordpress_bricks_builder_plugin_rce.yml @@ -58,7 +58,6 @@ tags: - Web.http_method - sourcetype - source - risk_score: 100 security_domain: network cve: - CVE-2024-25600 diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index 678bb61cf7..ed10071fc6 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -49,7 +49,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 72 required_fields: - Web.http_user_agent - Web.status diff --git a/detections/web/zscaler_adware_activities_threat_blocked.yml b/detections/web/zscaler_adware_activities_threat_blocked.yml index 5f2e135eb4..6e02290d65 100644 --- a/detections/web/zscaler_adware_activities_threat_blocked.yml +++ b/detections/web/zscaler_adware_activities_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - action - threatname diff --git a/detections/web/zscaler_behavior_analysis_threat_blocked.yml b/detections/web/zscaler_behavior_analysis_threat_blocked.yml index fc5f7f6c48..70662bb8c6 100644 --- a/detections/web/zscaler_behavior_analysis_threat_blocked.yml +++ b/detections/web/zscaler_behavior_analysis_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - action - threatname diff --git a/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml b/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml index cd49da9142..0af14a4625 100644 --- a/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml +++ b/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 32 required_fields: - action - threatname diff --git a/detections/web/zscaler_employment_search_web_activity.yml b/detections/web/zscaler_employment_search_web_activity.yml index 63a7d4278c..619bddefba 100644 --- a/detections/web/zscaler_employment_search_web_activity.yml +++ b/detections/web/zscaler_employment_search_web_activity.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 4 required_fields: - action - threatname diff --git a/detections/web/zscaler_exploit_threat_blocked.yml b/detections/web/zscaler_exploit_threat_blocked.yml index c7ae814a0a..06ebbb524c 100644 --- a/detections/web/zscaler_exploit_threat_blocked.yml +++ b/detections/web/zscaler_exploit_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 40 required_fields: - action - threatname diff --git a/detections/web/zscaler_legal_liability_threat_blocked.yml b/detections/web/zscaler_legal_liability_threat_blocked.yml index 0374908080..34798bfdf2 100644 --- a/detections/web/zscaler_legal_liability_threat_blocked.yml +++ b/detections/web/zscaler_legal_liability_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 16 required_fields: - action - threatname diff --git a/detections/web/zscaler_malware_activity_threat_blocked.yml b/detections/web/zscaler_malware_activity_threat_blocked.yml index 9ec20e0a1a..10445d094f 100644 --- a/detections/web/zscaler_malware_activity_threat_blocked.yml +++ b/detections/web/zscaler_malware_activity_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 40 required_fields: - action - threatname diff --git a/detections/web/zscaler_phishing_activity_threat_blocked.yml b/detections/web/zscaler_phishing_activity_threat_blocked.yml index c1d3357467..0775ba6e46 100644 --- a/detections/web/zscaler_phishing_activity_threat_blocked.yml +++ b/detections/web/zscaler_phishing_activity_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 16 required_fields: - action - threatname diff --git a/detections/web/zscaler_potentially_abused_file_download.yml b/detections/web/zscaler_potentially_abused_file_download.yml index b7fed03db7..8089c4ac5c 100644 --- a/detections/web/zscaler_potentially_abused_file_download.yml +++ b/detections/web/zscaler_potentially_abused_file_download.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - action - threatname diff --git a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml index c13b18286c..4b4bc567f4 100644 --- a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml +++ b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - action - threatname diff --git a/detections/web/zscaler_scam_destinations_threat_blocked.yml b/detections/web/zscaler_scam_destinations_threat_blocked.yml index 17755e36e5..d5810096fc 100644 --- a/detections/web/zscaler_scam_destinations_threat_blocked.yml +++ b/detections/web/zscaler_scam_destinations_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 8 required_fields: - action - threatname diff --git a/detections/web/zscaler_virus_download_threat_blocked.yml b/detections/web/zscaler_virus_download_threat_blocked.yml index 3ae874d2b7..e51131ecef 100644 --- a/detections/web/zscaler_virus_download_threat_blocked.yml +++ b/detections/web/zscaler_virus_download_threat_blocked.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 40 required_fields: - action - threatname diff --git a/docs/yaml-spec/detection_spec.yml b/docs/yaml-spec/detection_spec.yml index b94dd282b3..c6fe554374 100644 --- a/docs/yaml-spec/detection_spec.yml +++ b/docs/yaml-spec/detection_spec.yml @@ -115,7 +115,7 @@ tags: description: List of products that are related to the detection enum: [Splunk Enterprise Security, Splunk Enterprise, Splunk Cloud] required: true - risk_score: + type: int description: A number between 1-100 that represents the risk score of the detection. The risk score will be calculated based on the confidence and impact. required: true