Branch was auto-updated.

detections/endpoint/windows_event_log_cleared.yml

@@ -56,3 +56,16 @@ tags:
   - EventCode
   - dest
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "Windows event logs cleared on $dest$ via EventCode $EventCode$"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/windows_security_account_manager_stopped.yml

@@ -47,3 +47,24 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: "The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process
+    type: Process
+    role:
+    - Target

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -64,3 +64,22 @@ tags:
   - Description
   - Command
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  message: "A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -64,3 +64,22 @@ tags:
   - Description
   - Command
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  message: "A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target

detections/endpoint/winword_spawning_cmd.yml

@@ -50,3 +50,24 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  message: "$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks."
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target

detections/endpoint/winword_spawning_powershell.yml

@@ -52,3 +52,24 @@ tags:
   - user
   - parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  message: "$parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks"
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target