diff --git a/baselines/deprecated/.gitkeep b/baselines/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/baselines/previously_seen_aws_cross_account_activity___initial.yml b/baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml similarity index 98% rename from baselines/previously_seen_aws_cross_account_activity___initial.yml rename to baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml index 6fad8d0f18..3cc411008a 100644 --- a/baselines/previously_seen_aws_cross_account_activity___initial.yml +++ b/baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline -status: production +status: deprecated description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___update.yml b/baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml similarity index 98% rename from baselines/previously_seen_aws_cross_account_activity___update.yml rename to baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml index 9cb9c956b9..bc8eee0872 100644 --- a/baselines/previously_seen_aws_cross_account_activity___update.yml +++ b/baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline -status: production +status: deprecated description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/contentctl.yml b/contentctl.yml index 401119b03c..0fec06f9bf 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.1.1 + version: 5.2.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -218,11 +218,11 @@ apps: version: 3.1.0 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-github_310.tgz -- uid: 2882 +- uid: 3471 title: Splunk Add-on for AppDynamics appid: Splunk_TA_AppDynamics - version: 3.1.0 + version: 3.0.0 description: The Splunk Add-on for AppDynamics enables you to easily configure data inputs to pull data from AppDynamics' REST APIs - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_310.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_300.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index edd56c9a67..de5501d507 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -1,9 +1,22 @@ name: ASL AWS CloudTrail id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898 -version: 1 -date: '2025-01-14' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for ASL AWS CloudTrail +description: Represents AWS API dataset data collection from Amazon Security Lake. +mitre_components: +- Cloud Service Metadata +- Cloud Service Modification +- Cloud Storage Access +- Instance Creation +- Instance Deletion +- Instance Start +- Instance Stop +- Instance Modification +- Cloud Storage Creation +- Cloud Storage Deletion +- Cloud Service Enumeration +- Cloud Storage Enumeration source: aws_asl sourcetype: aws:asl separator: api.operation @@ -12,11 +25,9 @@ supported_TA: url: https://splunkbase.splunk.com/app/1876 version: 7.9.1 output_fields: -- action - dest - user - user_agent -- status - src - vendor_account - vendor_region diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index a20439b21c..ed02a878ef 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -1,9 +1,17 @@ name: AWS Cloudfront id: 780086dc-2384-45b6-ade7-56cb00105464 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS Cloudfront +description: Logs requests made to AWS CloudFront distributions, including details + on client access, response data, and performance metrics. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Response Metadata +- Response Content +- Logon Session Metadata +- Cloud Service Metadata source: aws sourcetype: aws:cloudfront:accesslogs supported_TA: diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 560f4ec819..cf9dde5517 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -3,7 +3,7 @@ id: e8ace6db-1dbd-4c72-a1fb-334684619a38 version: 1 date: '2024-07-24' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail +description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName @@ -11,12 +11,3 @@ supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 version: 7.9.1 -output_fields: -- action -- dest -- user -- user_agent -- src -- vendor_account -- vendor_region -- vendor_product diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 909af5d7de..29795820e8 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -1,12 +1,20 @@ name: AWS CloudTrail AssumeRoleWithSAML id: 1e28f2a6-2db9-405f-b298-18734a293f77 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail AssumeRoleWithSAML +description: Logs attempts to assume roles via SAML authentication in AWS, including + details of identity provider and role mapping. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata +- Cloud Service Metadata +- Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -125,7 +133,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "pri "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 7078b7a26c..e16de1c2a0 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -1,12 +1,20 @@ name: AWS CloudTrail ConsoleLogin id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail ConsoleLogin +description: Logs attempts to sign in to the AWS Management Console, including successful + and failed login events. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata +- Logon Session Metadata +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +109,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "acco "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 8e585a5e09..1a4c1336dd 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CopyObject id: 965083f4-64a8-403f-99cc-252e1a6bd3b6 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CopyObject +description: Logs operations that copy objects within or between AWS S3 buckets, including + details of source and destination. +mitre_components: +- Cloud Storage Access +- Cloud Storage Modification +- Cloud Storage Metadata +- Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -118,7 +125,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "111111111111", "eventCategory": "Data"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 8295e3b181..b4b59f6929 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateAccessKey id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateAccessKey +description: Logs the creation of new AWS access keys, including details of the associated + user and permissions. +mitre_components: +- User Account Creation +- User Account Metadata +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -102,7 +109,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121521347698"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index ca084d10a3..2c8d4b9235 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateKey id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateKey +description: Logs the creation of new AWS KMS keys, including details of key properties + and associated metadata. +mitre_components: +- Cloud Service Creation +- Cloud Service Metadata +- Instance Creation +- Volume Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -149,7 +156,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index c6a66e3f32..b62632e6ca 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateLoginProfile id: 0024fdb1-0d62-4449-970a-746952cf80b6 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateLoginProfile +description: Logs the creation of login profiles for IAM users, including associated + metadata and authentication settings. +mitre_components: +- User Account Creation +- User Account Metadata +- Logon Session Metadata +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +108,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 832dcc56b7..1050cb7cfc 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateNetworkAclEntry id: 45934028-10ec-4ab5-a7b1-a6349b833e67 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateNetworkAclEntry +description: Logs the creation of new entries in a network ACL, including rules to + allow or deny specific network traffic. +mitre_components: +- Firewall Rule Modification +- Network Connection Creation +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -120,7 +127,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index aecc7809b4..b14b4560af 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreatePolicyVersion id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreatePolicyVersion +description: Logs the creation of new versions of IAM policies, including changes + to permissions and attached roles or resources. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- User Account Metadata +- Group Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -105,7 +112,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index b9a3c9f135..77af285d56 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateSnapshot id: 514135a2-f4b2-4d32-8f31-d87824887f9f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateSnapshot +description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon + EBS volume, including details about the snapshot ID and resource type. +mitre_components: +- Snapshot Creation +- Snapshot Metadata +- Volume Metadata +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -117,7 +124,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index e7fee0117d..7e4c4a3a93 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateTask id: 6501e4fe-05b2-45f1-bd51-9e06a94fa7d9 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateTask +description: Logs the creation of a new task in AWS services, such as ECS, including + details about the task definition and resource allocation. +mitre_components: +- Scheduled Job Creation +- Scheduled Job Metadata +- Cloud Service Metadata +- Instance Creation source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -120,7 +127,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "datasync.us-west-2.amazonaws.com"}, "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index aac3d7e54e..776eb8f209 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail CreateVirtualMFADevice id: 13e6e952-0dad-4190-865c-fb5911725f7a -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail CreateVirtualMFADevice +description: Logs the creation of a new virtual multi-factor authentication (MFA) + device, including details about the associated user and configuration. +mitre_components: +- User Account Creation +- User Account Metadata +- Cloud Service Creation +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -99,7 +106,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "140429656527", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index f75ae55128..c47e9a88e1 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeactivateMFADevice id: 7397a10b-1150-4de9-8062-a96454ae53b2 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeactivateMFADevice +description: Logs the deactivation of a multi-factor authentication (MFA) device, + including details about the associated user and the device. +mitre_components: +- User Account Modification +- User Account Metadata +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -99,7 +106,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index adac6bc3c5..a62a54cd72 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail DeleteAccountPasswordPolicy id: b0730ac8-0992-4de8-b000-2c7d0fc7a67f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteAccountPasswordPolicy +description: Logs the deletion of an account-level password policy in AWS, including + details about the account and policy being removed. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -99,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index d3f4838723..1c9d1a53e1 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteAlarms id: b0730ac8-0992-4de8-b000-2c7d0fc7a61f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Bhavin Patel, Splunk -description: Data source object for AWS CloudTrail DeleteAlarms +description: Logs the deletion of CloudWatch alarms, including details about the alarm + names and associated monitoring configurations. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Application Log Content +- Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -140,7 +147,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index e9f71c39dd..5f4296ac6d 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteDetector id: 5d8bd475-c8bc-4447-b27f-efa508728b90 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteDetector +description: Logs the deletion of an Amazon GuardDuty detector, including details + about the detector ID and associated configurations. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Host Status +- Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -97,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index fb6fcd293c..b03e2e60ed 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteGroup id: c95308a4-a943-42ca-b112-f90a05c21bd3 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteGroup +description: Logs the deletion of an IAM group in AWS, including details about the + group name and its associated policies or members. +mitre_components: +- Group Modification +- Group Metadata +- User Account Metadata +- Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +108,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121522247101"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 5dfa194a17..3e44026c08 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -1,12 +1,18 @@ name: AWS CloudTrail DeleteIPSet id: ebdeeb63-77a0-4808-a6fe-549956731377 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteIPSet +description: Logs the deletion of an IP set in AWS WAF or GuardDuty, including details + about the IP set ID and its associated configurations. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Firewall Rule Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -98,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index b26cfaec87..43f7c60785 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteLogGroup id: 60cf6a69-fa43-4a6c-8808-e9fb46bf387f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteLogGroup +description: Logs the deletion of a CloudWatch log group, including details about + the log group name and associated resources. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Application Log Content +- Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -99,7 +106,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 7fc4b58fb7..f727440943 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteLogStream id: 6f8bb808-89f8-465e-a34d-229df2f46402 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteLogStream +description: Logs the deletion of a log stream within a CloudWatch log group, including + details about the stream name and associated log group. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Application Log Content +- Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -100,7 +107,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index d126f8eec4..e0150ee434 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -1,12 +1,18 @@ name: AWS CloudTrail DeleteNetworkAclEntry id: a0dd0f10-cc03-425d-bd5a-e1e0d954b856 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteNetworkAclEntry +description: Logs the deletion of a network ACL entry in AWS, including details about + the rule number and associated network ACL. +mitre_components: +- Firewall Rule Modification +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -109,7 +115,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "b9e05770-e9b0-4ba1-91e8-6537097e06e7", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index c98ed8eef4..89614df265 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail DeletePolicy id: d190d23a-2c59-4a0e-9c55-a53ebef28ee5 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeletePolicy +description: Logs the deletion of an IAM policy in AWS, including details about the + policy name and its associated roles or users. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +106,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "abd071bf-0a38-4fab-af4a-5eee55f0935e", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "151521547504"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 3fd4966201..72030603f3 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteRule id: b5760623-f3ca-492d-a372-d5c2b3567dfc -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteRule +description: Logs the deletion of an event rule in AWS EventBridge, including details + about the rule name and its associated targets or schedules. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Scheduled Job Modification +- Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +108,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index ccba4f7ad5..09cbca6325 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteSnapshot id: b0731ac8-0992-4de8-b000-2c7d0fc2a61f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Bhavin Patel, Splunk -description: Data source object for AWS CloudTrail DeleteSnapshot +description: Logs the deletion of a cloud resource snapshot, such as an Amazon EBS + snapshot, including details about the snapshot ID and associated resource. +mitre_components: +- Snapshot Deletion +- Snapshot Metadata +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -144,7 +151,6 @@ example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "AssumedRole", " "managementEvent": true, "recipientAccountId": "11111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 50b9c6c832..d0016cc082 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -1,12 +1,19 @@ name: AWS CloudTrail DeleteTrail id: a5af09ff-07b6-4df6-92a0-2146bfe402c8 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteTrail +description: Logs the deletion of an AWS CloudTrail trail, including details about + the trail name and its associated logging configurations. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- Application Log Content +- Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -97,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 35d80d2cf2..0cdeb40364 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail DeleteVirtualMFADevice id: 84a08d6b-3d59-4260-8cab-84278ada262f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteVirtualMFADevice +description: Logs an event when a virtual Multi-Factor Authentication (MFA) device + is deleted in AWS CloudTrail. +mitre_components: +- User Account Authentication +- User Account Deletion source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -99,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index ab9fadfa4f..8ed4750b8b 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail DeleteWebACL id: 90da5f08-7961-4c29-8de8-01364982aadf -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DeleteWebACL +description: Logs an event when a Web Access Control List (WebACL) is deleted in AWS + CloudTrail. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -101,7 +106,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index bb05e04cf1..f4d761a495 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail DescribeEventAggregates id: 7efe4afe-62ae-4f96-81d1-76598ea37fc2 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DescribeEventAggregates +description: Logs an event when aggregate details about AWS events are queried, often + for analysis. +mitre_components: +- Cloud Service Enumeration +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -96,7 +101,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "AwsApiCall", "managementEvent": true, "recipientAccountId": "1111111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 25383e9108..8ce5b9af14 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -1,12 +1,18 @@ name: AWS CloudTrail DescribeImageScanFindings id: 688ea789-9ba2-4970-90a2-17e541e273c9 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail DescribeImageScanFindings +description: Logs an event when findings from an image vulnerability scan are described + using the DescribeImageScanFindings operation in AWS CloudTrail. +mitre_components: +- Image Metadata +- Image Modification +- Malware Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -112,15 +118,15 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "accountId": "111111111111", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:iam::111111111111:role/aws-reserved/test/region/group", "accountId": "111111111111", - "userName": "test"}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-11T09:42:53Z", - "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", "eventSource": - "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": "eu-central-1", - "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 - Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 + "userName": "test"}, "webIdFederationData" : {}, "attributes": {"creationDate": + "2021-08-11T09:42:53Z", "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", + "eventSource": "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": + "eu-central-1" , "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 + aws-sdk-java/1.11.1030 Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/legacy", "requestParameters": {"repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "maxResults": 1000}, "responseElements": {"registryId": "111111111111", "repositoryName": - "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, + "devsecops/cat_dog_client", "imageId": {"imageDigest" : "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "imageScanStatus": {"status": "COMPLETE", "description": "The scan was completed successfully."}, "imageScanFindings": {"imageScanCompletedAt": "Aug 11, 2021, 11:30:16 AM", "vulnerabilitySourceUpdatedAt": "Aug 11, 2021, 1:17:52 AM", "findings": [{"name": @@ -376,7 +382,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17498", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, - {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, + {"key": "package_name", "value": "libssh2"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-17543", "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue @@ -409,7 +415,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2011-3374", "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential - man-in-the-middle attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3374", + man-in-the-middle attack.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-3374", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.2.3"}, {"key": "package_name", "value": "apt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": @@ -564,7 +570,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-5709", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": - "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", + "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36222", "description": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and @@ -651,7 +657,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.32-2.2~deb10u1"}, {"key": "package_name", "value": "libxslt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, - {"name": "CVE-2009-4487", "description": "nginx 0.7.64 writes data to a log file + {"name": "CVE-2009-4487" , "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window''s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", @@ -666,7 +672,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": - "4"}]}, {"name": "CVE-2015-3276", "description": "The nss_parse_ciphers function + "4"}]}, {"name": "CVE-2015-3276" , "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "uri": @@ -689,7 +695,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": - "5"}]}, {"name": "CVE-2010-0928", "description": "OpenSSL 0.9.8i on the Gaisler + "5"}]}, {"name": "CVE-2010-0928" , "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate @@ -744,10 +750,10 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.8"}]}, {"name": "CVE-2011-4116", "description": "_is_safe in the File::Temp module for - Perl does not properly handle symlinks.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-4116", + Perl does not properly handle symlinks.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-4116", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": - "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR", - "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, + "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR" + , "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-19882", "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects @@ -771,8 +777,8 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.9"}]}, {"name": "CVE-2013-4235", "description": "shadow: TOCTOU (time-of-check time-of-use) - race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235", - "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": + race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235" + , "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13529", "description": "An exploitable denial-of-service vulnerability @@ -817,7 +823,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " {"name": "CVE-2021-20193", "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from - this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", + this vulnerability is to system availability." , "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, @@ -839,19 +845,19 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.", "uri": "https://security-tracker.debian.org/tracker/CVE-2014-8130", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": - "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": + "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-5563", "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution - via a crafted bmp image to tools/bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", + via a crafted bmp image to tools/bmp2tiff." , "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": - "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": + "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35522", "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35522", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": - "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": + "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-9117", "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information @@ -881,7 +887,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " comparison also didn''t include the ''issuer cert'' which a transfer can setto qualify how to verify the server certificate.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22924", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, - {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-38115", "description": + {"key": "package_name", "value": "curl" }]}, {"name": "CVE-2021-38115", "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-38115", @@ -894,7 +900,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 8433aa0149..8e38543275 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail GetAccountPasswordPolicy id: 439bdc53-6e4b-4cd7-b326-86c7317fd396 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail GetAccountPasswordPolicy +description: Logs an event when a request is made to get the account password policy + in AWS CloudTrail. +mitre_components: +- User Account Authentication +- User Account Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -98,7 +103,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "iam.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index b6c55f6757..e56c84bf5c 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -1,12 +1,18 @@ name: AWS CloudTrail GetObject id: 5063cb10-84c0-44af-ade4-ab9ecad11dfe -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail GetObject +description: Logs an event when a request is made to access an object stored in an + AWS S3 bucket. +mitre_components: +- Cloud Storage Access +- Cloud Storage Metadata +- Cloud Storage Enumeration source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -112,7 +118,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "eventCategory": "Data", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "security-content.s3.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index f7f9adc714..f3d3430ab7 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail GetPasswordData id: 6ff2ce99-85b1-4c17-888a-56dbc3570671 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail GetPasswordData +description: Logs an event when a request is made to retrieve the administrator password + of an EC2 instance. +mitre_components: +- Instance Metadata +- User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -114,7 +119,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index ca1acee232..f8f986b05b 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail JobCreated id: 6473289b-d097-4c86-a837-3cc5ae408155 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail JobCreated +description: Logs an event when a new job is created in AWS CloudTrail. +mitre_components: +- Scheduled Job Creation +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -83,7 +87,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"accountId": "1111111111 "status": "New", "jobEventId": "4e70d2f1053c07a79d9be9a14e486020", "failureCodes": [], "statusChangeReason": []}, "eventCategory": "Management"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index c9d2597bf2..1ead1251b5 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -1,12 +1,18 @@ name: AWS CloudTrail ModifyDBInstance id: bfa2912d-1a33-4b05-be46-543874d68241 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail ModifyDBInstance +description: Logs an event when a modification is made to an AWS database instance, + such as parameters or configurations. +mitre_components: +- Instance Modification +- Cloud Service Modification +- Instance Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -192,7 +198,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4b550d9c9a..904f13b30d 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail ModifyImageAttribute id: 667c2115-8082-419e-b541-8150066bda4d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail ModifyImageAttribute +description: Logs an event when the attributes of an Amazon Machine Image (AMI) are + modified. +mitre_components: +- Image Modification +- Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -107,7 +112,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 2a1711a395..c470e6be6c 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail ModifySnapshotAttribute id: 7e5aa947-3a0d-4ee5-b800-0c10b555da05 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail ModifySnapshotAttribute +description: Logs an event when modifications are made to the attributes of a snapshot + in AWS CloudTrail. +mitre_components: +- Snapshot Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -100,7 +104,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 8607f79db3..b2ebffb45a 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail PutBucketAcl id: 28fffbfd-d98d-4a42-990b-b04ab47422eb -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutBucketAcl +description: Logs an event when an ACL is set or modified for an S3 bucket in AWS + CloudTrail. +mitre_components: +- Cloud Storage Modification +- Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -115,7 +120,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "ARN": "arn:aws:s3:::patricktestbucket19"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 8fb1f0ea5d..1bc07c8a9b 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail PutBucketLifecycle id: 1c73e954-87b6-4bd7-ac6a-5db7c4082b22 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutBucketLifecycle +description: Logs an event when a lifecycle configuration is added to an S3 bucket + in AWS CloudTrail. +mitre_components: +- Cloud Storage Modification +- Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -119,7 +124,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index d089c50bc7..571be4761b 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail PutBucketReplication id: 0e1362eb-e592-419f-8fa5-556d3a122417 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutBucketReplication +description: Logs an event when replication configurations are added or modified for + an S3 bucket. +mitre_components: +- Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -140,7 +144,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "s3.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index f7d9ea6c70..5f20cf5d96 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail PutBucketVersioning id: 17b2fc7d-c8ce-487c-8815-f9a65a09e980 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutBucketVersioning +description: Logs an event when the bucket versioning state is modified in an AWS + S3 bucket. +mitre_components: +- Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -128,7 +132,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "s3.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 00942041d0..7a084f0645 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail PutImage id: bb13f10d-0d8c-4fde-9136-b7cfd930e87c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutImage +description: Logs an event when a container image is uploaded to a repository in AWS + CloudTrail. +mitre_components: +- Image Creation +- Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -150,8 +155,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' output_fields: -- action -- dest - user - user_agent - src diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index d2e74b6a55..eaad6195c8 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -1,9 +1,10 @@ name: AWS CloudTrail PutKeyPolicy id: 9c54c86b-43b9-4bb8-915d-6838beb7f07c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail PutKeyPolicy +description: Logs changes made to AWS Key Management Service (KMS) key policies, including + updates and permission assignments. source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName @@ -94,6 +95,8 @@ fields: - vendor_account - vendor_product - vendor_region +mitre_components: +- Cloud Service Modification example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": @@ -131,7 +134,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index df21b230e8..38ff220557 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail ReplaceNetworkAclEntry id: db0c240e-3754-40e4-86ef-cde018ee9f65 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail ReplaceNetworkAclEntry +description: Logs an event when a network ACL entry is replaced within the AWS CloudTrail. +mitre_components: +- Firewall Rule Modification +- Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -117,7 +121,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 0e1b6c9c57..b52214773a 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail SetDefaultPolicyVersion id: 06e0b5a0-8d36-485e-befc-4ae79d77ef6c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail SetDefaultPolicyVersion +description: Logs an event when the default version of a resource policy in AWS is + set or changed. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -98,7 +103,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index db0ffc8259..ca0aac4ceb 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail StopLogging id: c5de7c54-4809-4659-bf9f-3bacf8bdfd35 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail StopLogging +description: Logs an event when a cloud service in AWS, such as CloudTrail, is deactivated + or stopped. +mitre_components: +- Cloud Service Disable source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -94,7 +98,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 15abc1be57..f09d6ec3d6 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail UpdateAccountPasswordPolicy id: 35a8cc97-3600-40e1-a5d1-1c2ad5060be0 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail UpdateAccountPasswordPolicy +description: Logs an event when an AWS account's password policy is updated. +mitre_components: +- User Account Modification +- Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -106,7 +110,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index eda86cdbd3..5f0eb2607f 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -1,12 +1,16 @@ name: AWS CloudTrail UpdateLoginProfile id: 1db79158-e5d3-4d35-9d3c-586e44e09f1c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail UpdateLoginProfile +description: Logs an event when an IAM user's login profile is updated. +mitre_components: +- User Account Modification +- User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -96,7 +100,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index d2b4294c10..fac661b936 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail UpdateSAMLProvider id: e5eb628d-711e-499c-87d9-8fa5dee419ec -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail UpdateSAMLProvider +description: Logs an event when a SAML provider is updated in AWS. +mitre_components: +- Cloud Service Modification +- User Account Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -96,7 +101,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "AROAYTOGP2RLKFUVAQAIJ:rodsoto@rodsoto.onmicrosoft.com", "arn": "arn:aws:sts::111111111111:assumed-role/rodonmicrotestrole/rodsoto@rodsoto.onmicrosoft.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLMZGPIW6C", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLKFUVAQAIJ", "arn": - "arn:aws:iam::111111111111:role/rodonmicrotestrole", "accountId": "111111111111", + "arn:aws:iam::111111111111:role/rodonmicrotestrole", "accountId" : "111111111111", "userName": "rodonmicrotestrole"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-20T03:10:32Z"}}}, "eventTime": "2021-01-20T03:12:39Z", "eventSource": "iam.amazonaws.com", "eventName": "UpdateSAMLProvider", "awsRegion": @@ -186,7 +191,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", " "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 564b226acd..952af97ba0 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -1,12 +1,17 @@ name: AWS CloudTrail UpdateTrail id: d5b7a1eb-711a-4c96-aa93-235fe3c8a939 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS CloudTrail UpdateTrail +description: Logs an event when an AWS CloudTrail trail is updated, typically involving + changes to settings or configuration. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -106,7 +111,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' output_fields: -- action - dest - user - user_agent diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 6cdaddfb41..6393155303 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -1,12 +1,16 @@ name: AWS CloudWatchLogs VPCflow id: 38a34fc4-e128-4478-a8f4-7835d51d5135 -version: 1 +version: 2 author: Bhavin Patel, Splunk -date: '2024-07-18' -description: Data source object for AWS CloudWatchLogs VPCflow +date: '2025-01-23' +description: Logs an event when network traffic flow information such as source and + destination IPs, ports, protocol, and action (allow/deny) is captured for VPC in + AWS. +mitre_components: +- Network Traffic Flow +- Network Connection Creation source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow -separator: eventName supported_TA: - name: Splunk Add-on for AWS version: 7.9.1 diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 93d572e96f..8b14d2d73c 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -1,9 +1,15 @@ name: AWS Security Hub id: b02bfbf3-294f-478e-99a1-e24b8c692d7e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for AWS Security Hub +description: Logs an event when AWS Security Hub identifies potential security risks + or deviations from configured best practices across AWS accounts. +mitre_components: +- Cloud Service Metadata +- Cloud Service Enumeration +- Cloud Service Modification +- Cloud Service Disable source: aws_securityhub_finding sourcetype: aws:securityhub:finding supported_TA: diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index f3655cb473..0b25a4fb1d 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -3,7 +3,7 @@ id: 51ca21e5-bda2-4652-bb29-27c7bc18a81c version: 1 date: '2024-07-18' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory +description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad separator: operationName diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index bb89c9f522..45f3171f36 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -1,13 +1,20 @@ name: Azure Active Directory Add app role assignment to service principal id: 8b2e84cd-6db0-47e9-badc-75c17df1995f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Add app role assignment - to service principal +description: Logs the addition of an application role assignment to a service principal + in Azure Active Directory, including details about the role, service principal, + and the user or process performing the action. +mitre_components: +- User Account Modification +- Group Modification +- Cloud Service Modification +- Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index b6a1ddb637..361ec5afe2 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -1,12 +1,20 @@ name: Azure Active Directory Add member to role id: 1660d196-127f-4678-81b2-472d51711b07 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Add member to role +description: Logs the addition of a member to a directory role in Azure Active Directory, + including details about the role, the member added, and the user or process performing + the action. +mitre_components: +- Group Modification +- Group Metadata +- User Account Metadata +- Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index b6aa6ca101..1e80420bc9 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -1,12 +1,20 @@ name: Azure Active Directory Add owner to application id: e895ed56-7be4-4b3a-b782-ecd0f594ec4c -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Add owner to application +description: Logs the addition of an owner to an application in Azure Active Directory, + including details about the application, the owner added, and the user or process + performing the action. +mitre_components: +- User Account Modification +- Group Modification +- Cloud Service Modification +- Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index a95c5608a9..4900077c25 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -1,12 +1,20 @@ name: Azure Active Directory Add service principal id: fd89d337-e4c0-4162-ad13-bca36f096fe6 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Add service principal +description: Logs the creation of a new service principal in Azure Active Directory, + including details about the service principal, associated application, and the user + or process performing the action. +mitre_components: +- Cloud Service Creation +- Cloud Service Metadata +- User Account Metadata +- Active Directory Object Creation source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 6342cf8c07..9c65ffb874 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -1,12 +1,19 @@ name: Azure Active Directory Add unverified domain id: d4c01fb1-3b88-46d3-bd12-9b9e256450f7 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Add unverified domain +description: Logs the addition of an unverified domain to Azure Active Directory, + including details about the domain name and the user or process performing the action. +mitre_components: +- Domain Registration +- Cloud Service Modification +- Cloud Service Metadata +- Configuration Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index f9aa21eeb9..a3fabfa139 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -1,12 +1,20 @@ name: Azure Active Directory Consent to application id: 4c5d6c49-53e3-4980-a4de-c63e26291ed0 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Consent to application +description: Logs user or admin consent to an application's permissions in Azure Active + Directory, including details about the application, granted permissions, and the + consenting user or process. +mitre_components: +- User Account Modification +- Cloud Service Modification +- Cloud Service Metadata +- Configuration Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index e066c30adb..dc3b8dbf05 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Disable Strong Authentication id: 8f31966d-c496-496d-8837-f7fd11f31255 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Disable Strong Authentication +description: Logs an event when strong authentication methods are disabled in Azure + Active Directory. +mitre_components: +- User Account Authentication +- User Account Modification +- Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 9006554c9c..be0208edb9 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -1,12 +1,17 @@ name: Azure Active Directory Enable account id: cb49f3cd-04ad-415c-a5ed-9b27b2829fa7 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Enable account +description: Logs an event when an Azure Active Directory account is enabled. +mitre_components: +- User Account Modification +- User Account Authentication +- User Account Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 0de116563c..fca5f7cf97 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Invite external user id: d3818bd5-f283-4518-8b67-df19240c3e40 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Invite external user +description: Logs an event when an external user is invited to join an Azure Active + Directory tenant. +mitre_components: +- Active Directory Object Creation +- User Account Creation +- User Account Authentication source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index ea2737abe0..aff8092dee 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -1,12 +1,18 @@ name: Azure Active Directory Reset password (by admin) id: dcd0e4dc-68f8-4b77-a66f-89c57b3afa6b -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Reset password (by admin) +description: Logs an event when an admin resets a user's password in Azure Active + Directory. +mitre_components: +- User Account Authentication +- User Account Modification +- Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 57005e0347..70c7e43888 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Set domain authentication id: e7bcdab9-908c-40ab-ba38-5db54fa87750 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Set domain authentication +description: Logs an event when the authentication method for a domain in Azure Active + Directory is set or modified. +mitre_components: +- Active Directory Object Modification +- User Account Authentication +- Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 3fa92ed063..31a32e5a30 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Sign-in activity id: f9ed0a3a-9e20-4198-a035-d0a29593fbe0 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Sign-in activity +description: Logs an event when a user attempts to sign into Azure Active Directory, + capturing authentication details and outcomes. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 11088754fd..23dcecde69 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Update application id: 2c08188a-ba25-496e-87c7-803cf28b6c90 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Update application +description: Logs an event when an application in Azure Active Directory is updated, + such as changes to its settings or permissions. +mitre_components: +- Service Modification +- User Account Modification +- Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index f9fdc1fde2..058f400e1a 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -1,12 +1,18 @@ name: Azure Active Directory Update authorization policy id: c5b7ffcd-73d8-4fe5-afd8-b1218d715c0c -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Update authorization policy +description: Logs an event when an authorization policy is updated in Azure Active + Directory. +mitre_components: +- User Account Modification +- Group Modification +- Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index c606bd147b..9f99e199d8 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -1,12 +1,16 @@ name: Azure Active Directory Update user id: 5495c90a-047c-4b8e-b2fe-1db6282d3872 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory Update user +description: Logs an event when a user account is updated in Azure Active Directory. +mitre_components: +- User Account Modification +- User Account Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index d1fc611348..1379b9e4f8 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -1,14 +1,17 @@ name: Azure Active Directory User registered security info id: b63240de-8a01-4ba8-8987-89d18d4b375d -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: - Data source object for Azure Active Directory User registered security - info +description: Logs an event when a user registers or updates their security information + in Azure Active Directory. +mitre_components: +- User Account Modification +- User Account Metadata source: Azure AD sourcetype: azure:monitor:aad separator: operationName +separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 9e4291e040..d20eb1b740 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -1,14 +1,17 @@ name: Azure Audit Create or Update an Azure Automation account id: 2ab182e7-feda-4249-9418-32710b55a885 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: - Data source object for Azure Audit Create or Update an Azure Automation - account +description: Logs an event when an Azure Automation account is created or updated. +mitre_components: +- Cloud Service Creation +- Cloud Service Modification +- Cloud Service Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue +separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 945a2383aa..f2dbafa993 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -1,14 +1,17 @@ name: Azure Audit Create or Update an Azure Automation Runbook id: 2bd83221-7a8b-436f-9b2b-efa1d44d009e -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: - Data source object for Azure Audit Create or Update an Azure Automation - Runbook +description: Logs an event when a new Azure Automation Runbook is created or an existing + one is updated. +mitre_components: +- Scheduled Job Modification +- Scheduled Job Creation source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue +separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index fe6343c99e..a8c611852b 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -1,14 +1,17 @@ name: Azure Audit Create or Update an Azure Automation webhook id: 575faeb2-09d0-4849-b1f6-eae241f26ff2 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: - Data source object for Azure Audit Create or Update an Azure Automation - webhook +description: Logs an event when a webhook is created or updated in Azure Automation. +mitre_components: +- Scheduled Job Modification +- Cloud Service Modification +- Scheduled Job Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue +separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index c47465f05f..99c76ed47f 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -1,7 +1,7 @@ name: Azure Monitor Activity id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 -date: "2025-01-13" +date: '2025-01-13' author: Bhavin Patel, Splunk description: Data source object for Azure Monitor Activity. The Splunk Add-on for diff --git a/data_sources/bro.yml b/data_sources/bro.yml deleted file mode 100644 index 72d2cd5415..0000000000 --- a/data_sources/bro.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: Bro -id: c5d9612b-0ffd-44d3-8247-3cf3486ec5e2 -version: 1 -date: '2024-07-18' -author: Patrick Bareiss, Splunk -description: Data source object for Bro -source: bro:http:json -sourcetype: bro:http:json -supported_TA: [] diff --git a/data_sources/bro_conn.yml b/data_sources/bro_conn.yml new file mode 100644 index 0000000000..2344d857d7 --- /dev/null +++ b/data_sources/bro_conn.yml @@ -0,0 +1,18 @@ +name: Bro conn +id: c5a7e93b-2172-45a7-a7e9-3b217255a7f5 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs network connection metadata captured by Zeek (formerly Bro), including + details such as source and destination IPs, ports, connection state, and protocol. +mitre_components: +- Network Connection Creation +- Network Traffic Flow +- Response Metadata +- Application Log Content +source: bro:conn:json +sourcetype: bro:conn:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_dns.yml b/data_sources/bro_dns.yml new file mode 100644 index 0000000000..a87a59819a --- /dev/null +++ b/data_sources/bro_dns.yml @@ -0,0 +1,20 @@ +name: Bro dns +id: a4576cbf-06cc-4ed0-976c-bf06ccaed011 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs DNS queries and responses captured by Zeek (formerly Bro), including + details such as queried domains, resolved IPs, query types, and response codes. +mitre_components: +- Active DNS +- Passive DNS +- Network Traffic Content +- Network Traffic Flow +- Response Metadata +source: bro:dns:json +sourcetype: bro:dns:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 + diff --git a/data_sources/bro_files.yml b/data_sources/bro_files.yml new file mode 100644 index 0000000000..6185e27c8f --- /dev/null +++ b/data_sources/bro_files.yml @@ -0,0 +1,20 @@ +name: Bro files +id: f72d34d0-3495-4826-ad34-d03495782633 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs metadata about files transferred over the network captured by Zeek + (formerly Bro), including details such as file names, hashes, MIME types, and transfer + protocols. +mitre_components: +- File Metadata +- Network Traffic Content +- Network Traffic Flow +- Response Metadata +- Application Log Content +source: bro:files:json +sourcetype: bro:files:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_http.yml b/data_sources/bro_http.yml new file mode 100644 index 0000000000..02c2647022 --- /dev/null +++ b/data_sources/bro_http.yml @@ -0,0 +1,19 @@ +name: Bro http +id: c5d9612b-0ffd-44d3-8247-3cf3486ec5e2 +version: 3 +date: '2025-01-23' +author: Patrick Bareiss, Splunk +description: Logs HTTP traffic analyzed by Zeek (formerly Bro), including details + such as request methods, URLs, user agents, response codes, and headers. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Response Content +- Response Metadata +- Application Log Content +source: bro:http:json +sourcetype: bro:http:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_loaded_scripts.yml b/data_sources/bro_loaded_scripts.yml new file mode 100644 index 0000000000..016c7beb38 --- /dev/null +++ b/data_sources/bro_loaded_scripts.yml @@ -0,0 +1,18 @@ +name: Bro loaded_scripts +id: 81e08a21-a735-42b1-a08a-21a73582b1bf +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs details about the scripts loaded by Zeek (formerly Bro) during initialization, + including script names and paths. +mitre_components: +- Application Log Content +- Configuration Modification +- Script Execution +- OS API Execution +source: bro:loaded_scripts:json +sourcetype: bro:loaded_scripts:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_ntp.yml b/data_sources/bro_ntp.yml new file mode 100644 index 0000000000..f76e65c2ae --- /dev/null +++ b/data_sources/bro_ntp.yml @@ -0,0 +1,18 @@ +name: Bro ntp +id: 3f64a544-47a4-4958-a4a5-4447a47958df +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs Network Time Protocol (NTP) activity captured by Zeek (formerly + Bro), including details such as NTP requests, responses, and server metadata. +mitre_components: +- Network Traffic Flow +- Network Traffic Content +- Response Metadata +- Application Log Content +source: bro:ntp:json +sourcetype: bro:ntp:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_ocsp.yml b/data_sources/bro_ocsp.yml new file mode 100644 index 0000000000..fc3bd136a9 --- /dev/null +++ b/data_sources/bro_ocsp.yml @@ -0,0 +1,19 @@ +name: Bro ocsp +id: d20909ab-70be-409a-8909-ab70be609af1 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs Online Certificate Status Protocol (OCSP) activity captured by Zeek + (formerly Bro), including details such as certificate validation requests and responses. +mitre_components: +- Certificate Registration +- Network Traffic Flow +- Network Traffic Content +- Response Metadata +- Application Log Content +source: bro:ocsp:json +sourcetype: bro:ocsp:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_ssl.yml b/data_sources/bro_ssl.yml new file mode 100644 index 0000000000..42a8a59910 --- /dev/null +++ b/data_sources/bro_ssl.yml @@ -0,0 +1,19 @@ +name: Bro ssl +id: 22c637eb-f62e-41f0-8637-ebf62e11f0a8 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs SSL/TLS handshake and session details captured by Zeek (formerly + Bro), including certificates, cipher suites, and session information. +mitre_components: +- Certificate Registration +- Network Traffic Flow +- Network Traffic Content +- Response Metadata +- Application Log Content +source: bro:ssl:json +sourcetype: bro:ssl:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_weird.yml b/data_sources/bro_weird.yml new file mode 100644 index 0000000000..fe5a01ce05 --- /dev/null +++ b/data_sources/bro_weird.yml @@ -0,0 +1,19 @@ +name: Bro weird +id: e03762c5-c4b8-44e3-b762-c5c4b8e4e3b6 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs anomalous or unexpected network behaviors identified by Zeek (formerly + Bro), including protocol violations and unusual traffic patterns. +mitre_components: +- Network Traffic Flow +- Network Traffic Content +- Response Metadata +- Application Log Content +- Host Status +source: bro:weird:json +sourcetype: bro:weird:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/bro_x509.yml b/data_sources/bro_x509.yml new file mode 100644 index 0000000000..a5d7370c9e --- /dev/null +++ b/data_sources/bro_x509.yml @@ -0,0 +1,19 @@ +name: Bro x509 +id: e8792367-64b0-47e9-b923-6764b0f7e936 +version: 2 +date: '2025-01-23' +author: Jacob Delgado, SnapAttack +description: Logs details about X.509 certificates observed in network traffic captured + by Zeek (formerly Bro), including certificate fields, validity periods, and issuers. +mitre_components: +- Certificate Registration +- Network Traffic Content +- Response Metadata +- Application Log Content +- Host Status +source: bro:x509:json +sourcetype: bro:x509:json +supported_TA: +- name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.8 diff --git a/data_sources/circleci.yml b/data_sources/circleci.yml index 9dfcb06b20..dc231daca7 100644 --- a/data_sources/circleci.yml +++ b/data_sources/circleci.yml @@ -1,9 +1,16 @@ name: CircleCI id: 34ad06fc-a296-4ab5-8315-2f07714948e3 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for CircleCI +description: Logs activities related to CI/CD pipelines executed in CircleCI, including + job execution, workflow progress, and configuration changes. +mitre_components: +- Scheduled Job Execution +- Scheduled Job Metadata +- Application Log Content +- Configuration Modification +- Host Status source: circleci sourcetype: circleci supported_TA: diff --git a/data_sources/cisco_secure_application_appdynamics_alerts.yml b/data_sources/cisco_secure_application_appdynamics_alerts.yml index d4a59e0eb7..cdd022fe72 100644 --- a/data_sources/cisco_secure_application_appdynamics_alerts.yml +++ b/data_sources/cisco_secure_application_appdynamics_alerts.yml @@ -9,7 +9,7 @@ sourcetype: appdynamics_security supported_TA: - name: Splunk Add-on for AppDynamics url: https://splunkbase.splunk.com/app/3471 - version: 3.1.0 + version: 3.0.0 fields: - SourceType - apiServerExternal @@ -133,4 +133,11 @@ fields: - _si - _sourcetype - _time -example_log: '{ "SourceType": "secure_app_attacks", "attackId": "24815279", "attackSource": "EXTERNAL", "attackOutcome": "EXPLOITED", "attackTypes": "{SSRF}", "attackEventTrigger": "", "application": "AD-Ecommerce", "tier": "Order-Processing-Services", "businessTransaction": "Checkout", "attackStatus": "OPEN", "attackLastDetected": "2025-01-31 12:30:22 +0000 UTC", "attackEvents": [{"attackOutcome":"EXPLOITED","eventType":"SOCKET_RESOLVE","attackTypes":"SSRF","timestamp":"2025-01-31T12:30:22Z","applicationName":"AD-Ecommerce","tierName":"Order-Processing-Services","maliciousIpOut":"","maliciousIpSourceOut":"","detailJson":{"classname":"java.net.SocketPermission","ptype":"SOCKET","socketOut":"www.cisco.com","hostContext":"www.cisco.com","methodName":"sun.net.www.http.HttpClient.openServer","apiServerExternal":true,"apiServerInUrl":true},"blocked":false,"blockedReason":"","vulnerableMethod":"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)","matchedCveName":"CVE-2020-13934","keyInfo":"","cveId":"a21931cd-52fa-11ec-a8b2-8e3051145156","stackTrace":"java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)\nsun.net.www.http.HttpClient.openServer(HttpClient.java:510)\nsun.net.www.protocol.https.HttpsClient.\u003cinit\u003e(HttpsClient.java:264)\nsun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\norg.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule.login(SomeFile.java:12)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1022)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1020)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1019)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)\nsun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:91)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1466)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1464)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1463)\nsun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)\nservlet.ArgentoDemoApp$GenericExecution._executeServletCommand(ArgentoDemoApp.java:850)\nservlet.ArgentoDemoApp$GenericExecution.executeServletCommand(ArgentoDemoApp.java:778)\nservlet.ArgentoDemoApp$MyApplicationExecution.executeServletCommand(ArgentoDemoApp.java:718)\nservlet.ArgentoDemoApp._doGet(ArgentoDemoApp.java:441)\nservlet.ArgentoDemoApp.doGet(ArgentoDemoApp.java:376)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:634)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:741)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\norg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\norg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)\norg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\norg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)\norg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\norg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:745)\n","jvmId":"EEcommerce_MS_NODE","maliciousIpSource":"","webTransactionUrl":"https://localhost:8088/argentoDemoApp/execute?upload=https://www.cisco.com/c/dam/cdc/t/ctm-core.js","clientAddressType":4,"clientAddress":"218.132.217.179","serverPort":"1047","serverAddress":"75.155.150.130","clientPort":"68389","serverName":"/usr/src/argento/prod/demo-run/tomcat-demo-app/webapps/argentoDemoApp/","vulnerabilityInfo":{"cvePublishDate":"2020-07-15T16:40:14.601976Z","cvssScore":5.3,"cvssSeverity":"MEDIUM","cveNvdUrl":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-584427","incidentFirstDetected":"2020-07-15T16:40:14.601976Z","kennaScore":53.0971,"library":"org.apache.tomcat.embed:tomcat-embed-core","title":"Denial of Service (DoS)","type":"java","kennaActiveInternetBreach":false,"kennaEasilyExploitable":false,"kennaMalwareExploitable":false,"kennaPredictedExploitable":true,"kennaPopularTarget":false}}]}' +example_log: '{ "SourceType": "secure_app_attacks", "attackId": "24815279", "attackSource": + "EXTERNAL", "attackOutcome": "EXPLOITED", "attackTypes": "{SSRF}", "attackEventTrigger": + "", "application": "AD-Ecommerce", "tier": "Order-Processing-Services", "businessTransaction": + "Checkout", "attackStatus": "OPEN", "attackLastDetected": "2025-01-31 12:30:22 + +0000 UTC", "attackEvents": [{"attackOutcome":"EXPLOITED","eventType":"SOCKET_RESOLVE","attackTypes":"SSRF","timestamp":"2025-01-31T12:30:22Z","applicationName":"AD-Ecommerce","tierName":"Order-Processing-Services","maliciousIpOut":"","maliciousIpSourceOut":"","detailJson":{"classname":"java.net.SocketPermission","ptype":"SOCKET","socketOut":"www.cisco.com","hostContext":"www.cisco.com","methodName":"sun.net.www.http.HttpClient.openServer","apiServerExternal":true,"apiServerInUrl":true},"blocked":false,"blockedReason":"","vulnerableMethod":"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)","matchedCveName":"CVE-2020-13934","keyInfo":"","cveId":"a21931cd-52fa-11ec-a8b2-8e3051145156","stackTrace":"java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)\nsun.net.www.http.HttpClient.openServer(HttpClient.java:510)\nsun.net.www.protocol.https.HttpsClient.\u003cinit\u003e(HttpsClient.java:264)\nsun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\norg.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule.login(SomeFile.java:12)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1022)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1020)\njava.security.AccessController.doPrivileged(Native + Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1019)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)\nsun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:91)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1466)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1464)\njava.security.AccessController.doPrivileged(Native + Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1463)\nsun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)\nservlet.ArgentoDemoApp$GenericExecution._executeServletCommand(ArgentoDemoApp.java:850)\nservlet.ArgentoDemoApp$GenericExecution.executeServletCommand(ArgentoDemoApp.java:778)\nservlet.ArgentoDemoApp$MyApplicationExecution.executeServletCommand(ArgentoDemoApp.java:718)\nservlet.ArgentoDemoApp._doGet(ArgentoDemoApp.java:441)\nservlet.ArgentoDemoApp.doGet(ArgentoDemoApp.java:376)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:634)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:741)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\norg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\norg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)\norg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\norg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)\norg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\norg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:745)\n","jvmId":"EEcommerce_MS_NODE","maliciousIpSource":"","webTransactionUrl":"https://localhost:8088/argentoDemoApp/execute?upload=https://www.cisco.com/c/dam/cdc/t/ctm-core.js","clientAddressType":4,"clientAddress":"218.132.217.179","serverPort":"1047","serverAddress":"75.155.150.130","clientPort":"68389","serverName":"/usr/src/argento/prod/demo-run/tomcat-demo-app/webapps/argentoDemoApp/","vulnerabilityInfo":{"cvePublishDate":"2020-07-15T16:40:14.601976Z","cvssScore":5.3,"cvssSeverity":"MEDIUM","cveNvdUrl":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-584427","incidentFirstDetected":"2020-07-15T16:40:14.601976Z","kennaScore":53.0971,"library":"org.apache.tomcat.embed:tomcat-embed-core","title":"Denial + of Service (DoS)","type":"java","kennaActiveInternetBreach":false,"kennaEasilyExploitable":false,"kennaMalwareExploitable":false,"kennaPredictedExploitable":true,"kennaPopularTarget":false}}]}' diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index db2bebb83f..b9b50b6070 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -1,12 +1,21 @@ name: CrowdStrike ProcessRollup2 id: cbb06880-9dd9-4542-ac60-bd6e5d3c3e4e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for CrowdStrike ProcessRollup2 +description: Logs process-related activities captured by CrowdStrike, including process + creation, termination, and metadata such as hashes, parent processes, and command-line + arguments. +mitre_components: +- Process Creation +- Process Termination +- Process Metadata +- Command Execution +- OS API Execution source: crowdstrike sourcetype: crowdstrike:events:sensor separator: event_simpleName +separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 diff --git a/data_sources/crushftp.yml b/data_sources/crushftp.yml index 7c3f19a528..597fda30f8 100644 --- a/data_sources/crushftp.yml +++ b/data_sources/crushftp.yml @@ -1,9 +1,16 @@ name: CrushFTP id: 8a42ace5-e4c8-4653-80cf-1b8e7e6024ef -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for CrushFTP +description: Logs activities related to file transfers and user interactions in CrushFTP, + including file uploads, downloads, user authentication, and session details. +mitre_components: +- File Access +- File Metadata +- User Account Authentication +- Logon Session Metadata +- Network Traffic Content source: crushftp sourcetype: crushftp:sessionlogs supported_TA: [] diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index 202dea0c7c..0064416dbb 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -1,9 +1,16 @@ name: G Suite Drive id: 5f79120f-a235-4468-bd0d-55203758ac22 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for G Suite Drive +description: Logs activities related to Google Drive in G Suite, including file creation, + modification, sharing, and access details. +mitre_components: +- File Access +- File Creation +- File Modification +- Cloud Storage Access +- Cloud Storage Metadata source: http:gsuite sourcetype: gsuite:drive:json supported_TA: diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 159ec55541..2366e69b41 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -1,9 +1,15 @@ name: G Suite Gmail id: 706c3978-41de-406b-b6e0-75bd01e12a5d -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for G Suite Gmail +description: Logs Gmail activities in G Suite, including email sending, receiving, + and access details, as well as potential security-related events. +mitre_components: +- Application Log Content +- User Account Metadata +- Email Metadata +- Cloud Service Metadata source: http:gsuite sourcetype: gsuite:gmail:bigquery supported_TA: diff --git a/data_sources/github_webhooks.yml b/data_sources/github_webhooks.yml index 0033c79a08..fc952dee3f 100644 --- a/data_sources/github_webhooks.yml +++ b/data_sources/github_webhooks.yml @@ -1,9 +1,15 @@ name: GitHub Webhooks id: 88aa4632-3c3e-43f6-a00a-998d71f558e3 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for GitHub Webooks +description: Data source object for GitHub Webooks +mitre_components: +- User Account Authentication +- Configuration Modification +- Application Log Content +- User Account Metadata +- Scheduled Job Metadata source: github sourcetype: aws:firehose:json supported_TA: [] diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index 1e651b883e..cdc72f6062 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -1,7 +1,7 @@ name: Google Workspace id: f1a044e3-113a-4e4d-84f2-b153ade83087 version: 1 -date: "2025-02-21" +date: '2025-02-21' author: Bhavin Patel, Splunk description: Data source object for Google Workspace source: google_workspace diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index aeebca2cd8..37b5e7dfd3 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -1,12 +1,19 @@ name: Google Workspace login_failure id: cabec7cf-4008-4899-b47e-39c34a9a1255 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Google Workspace login_failure +description: Logs failed login attempts to Google Workspace accounts, including details + about the user, IP address, and reason for failure. +mitre_components: +- User Account Authentication +- Logon Session Metadata +- User Account Metadata +- Application Log Content source: gws:reports:admin sourcetype: gws:reports:admin separator: event.name +separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 2352174a50..ac11eece48 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -1,12 +1,19 @@ name: Google Workspace login_success id: bffe8013-9cdf-4fe6-9c1b-6784391a4951 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Google Workspace login_success +description: Logs successful login attempts to Google Workspace accounts, including + details about the user, IP address, and session metadata. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata +- Logon Session Metadata source: gws:reports:admin sourcetype: gws:reports:admin separator: event.name +separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 diff --git a/data_sources/ivanti_vtm_audit.yml b/data_sources/ivanti_vtm_audit.yml index 0bdb54223a..31e1bdc95e 100644 --- a/data_sources/ivanti_vtm_audit.yml +++ b/data_sources/ivanti_vtm_audit.yml @@ -1,9 +1,16 @@ name: Ivanti VTM Audit id: b04be6e5-2002-4a49-8722-52285635b8f5 -version: 1 -date: '2024-08-19' +version: 2 +date: '2025-01-23' author: Michael Haag, Splunk -description: Data source object for Ivanti Virtual Traffic Manager (vTM) +description: Logs administrative and operational activities in Ivanti Virtual Traffic + Manager (VTM), including configuration changes, user actions, and system events. +mitre_components: +- Configuration Modification +- Application Log Content +- User Account Metadata +- Host Status +- Service Modification source: ivanti_vtm sourcetype: ivanti_vtm_audit supported_TA: [] @@ -16,4 +23,5 @@ fields: - AUTH - USER - GROUP -example_log: '[19/Aug/2024:19:41:22 +0000] USER=!!ABSENT!! GROUP=!!ABSENT!! AUTH=!!ABSENT!! IP=!!ABSENT!! OPERATION=adduser MODUSER=newadmin MODGROUP=admin' +example_log: '[19/Aug/2024:19:41:22 +0000] USER=!!ABSENT!! GROUP=!!ABSENT!! AUTH=!!ABSENT!! + IP=!!ABSENT!! OPERATION=adduser MODUSER=newadmin MODGROUP=admin' diff --git a/data_sources/kubernetes_audit.yml b/data_sources/kubernetes_audit.yml index e0dfd3c812..7b7065c6f4 100644 --- a/data_sources/kubernetes_audit.yml +++ b/data_sources/kubernetes_audit.yml @@ -1,9 +1,17 @@ name: Kubernetes Audit id: 6c25181a-0c07-4aaf-90e6-77ab1f0e6699 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Kubernetes Audit +description: Logs activities within a Kubernetes cluster, including API server requests, + resource access, configuration changes, and user authentication events. +mitre_components: +- Pod Metadata +- Pod Modification +- Cluster Metadata +- User Account Authentication +- Configuration Modification +- Application Log Content source: kubernetes sourcetype: _json supported_TA: [] diff --git a/data_sources/kubernetes_falco.yml b/data_sources/kubernetes_falco.yml index 568d4be771..f5f7cf1762 100644 --- a/data_sources/kubernetes_falco.yml +++ b/data_sources/kubernetes_falco.yml @@ -1,9 +1,17 @@ name: Kubernetes Falco id: 23c0eeed-840a-4711-a41b-6819c1ffbba5 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Kubernetes Falco +description: Logs suspicious or anomalous activities within a Kubernetes environment + detected by Falco, including system calls, file access, and network activity. +mitre_components: +- File Access +- Network Traffic Content +- Process Creation +- Process Modification +- Application Log Content +- Host Status source: kubernetes sourcetype: kube:container:falco supported_TA: [] diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index acab747455..34e9ca198f 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -3,9 +3,18 @@ id: 30f79353-e1d2-4585-8735-1e0359559f3f version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Add User Type +description: Logs activities related to the addition of a new user account on a Linux + system, including details about the username, UID, and the process initiating the + action. +mitre_components: +- User Account Creation +- User Account Metadata +- OS API Execution +- Application Log Content source: auditd sourcetype: auditd +separator: type +separator_value: ADD_USER configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 82bd7bcacc..9f46c3a637 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -3,9 +3,18 @@ id: 9ef6364d-cc67-480e-8448-3306829a6a24 version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Execve Type +description: Logs the execution of processes on a Linux system, including details + about the executed command, arguments, and the initiating process. source: auditd sourcetype: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: EXECVE configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 25c1cb029a..e61df5b6d2 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -3,9 +3,18 @@ id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Path Type +description: Logs file system access events on a Linux system, including details about + file paths, permissions, and associated processes. +mitre_components: +- File Access +- File Metadata +- Process Metadata +- OS API Execution +- Application Log Content source: auditd sourcetype: auditd +separator: type +separator_value: PATH configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 86c68368aa..f4123c4d2e 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -3,7 +3,15 @@ id: 5a25984a-2789-400a-858b-d75c923e06b1 version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Proctitle Type +description: Logs the full command-line arguments of a process execution on a Linux + system, providing visibility into the executed command and its parameters. +mitre_components: +- Command Execution +- Process Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: PROCTITLE source: auditd sourcetype: auditd configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index e65d033de2..944f34b46b 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -3,7 +3,16 @@ id: 0643483c-bc62-455c-8d6e-1630e5f0e00d version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Service Stop Type +description: Logs events related to the stoppage of a service on a Linux system, including + details about the service name, the process initiating the stop, and associated + timestamps. +mitre_components: +- Service Modification +- Service Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: SERVICE_STOP source: auditd sourcetype: auditd configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 00a1fa9493..838787f1fe 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -3,9 +3,17 @@ id: 4dff7047-0d43-4096-bb3f-b756c889bbad version: 2 date: '2025-02-20' author: Teoderick Contreras, Splunk -description: Data source object for Linux Auditd Syscall Type +description: Logs system calls made by processes on a Linux system, including details + about the syscall number, arguments, return values, and associated process metadata. +mitre_components: +- OS API Execution +- Process Metadata +- Application Log Content +- Host Status source: auditd sourcetype: auditd +separator: type +separator_value: syscall configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 468d387446..7e6390b41b 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -1,9 +1,16 @@ name: Linux Secure id: 9a47d88b-1b17-49ce-a0ef-b440ddbd98bb -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Linux Secure +description: Logs authentication and authorization events on a Linux system, including + login attempts, SSH connections, and privilege escalation activities. +mitre_components: +- User Account Authentication +- Logon Session Creation +- Logon Session Metadata +- User Account Metadata +- Application Log Content source: /var/log/secure sourcetype: linux_secure supported_TA: diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml index 3fd9ba4555..4f6665ecbc 100644 --- a/data_sources/ms365_defender_incident_alerts.yml +++ b/data_sources/ms365_defender_incident_alerts.yml @@ -1,9 +1,16 @@ name: MS365 Defender Incident Alerts id: 12345678-90ab-cdef-1234-567890abcdef -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Bhavin Patel, Splunk -description: Data source object for MS365 Defender Incident Alerts +description: Logs security incidents and correlated alerts in Microsoft 365 Defender, + including details about affected assets, threat types, and remediation steps. +mitre_components: +- Host Status +- User Account Metadata +- Application Log Content +- Malware Metadata +- Active Directory Object Access source: ms365_defender_incident_alerts sourcetype: ms365:defender:incident:alerts supported_TA: diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml index 92d4452143..f7429f3de6 100644 --- a/data_sources/ms_defender_atp_alerts.yml +++ b/data_sources/ms_defender_atp_alerts.yml @@ -1,9 +1,16 @@ name: MS Defender ATP Alerts id: 38f034ed-1598-46c8-95e8-14edf01fdf5d -version: 1 -date: '2024-10-30' +version: 2 +date: '2025-01-23' author: Bryan Pluta, Bhavin Patel, Splunk -description: Data source object for Microsoft Defender ATP Alerts +description: Logs security alerts generated by Microsoft Defender for Endpoint, including + information about detected threats, impacted devices, and recommended actions. +mitre_components: +- Host Status +- Malware Metadata +- Process Metadata +- User Account Metadata +- Application Log Content source: ms_defender_atp_alerts sourcetype: ms:defender:atp:alerts supported_TA: diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 5b6e0004b7..048998577a 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -1,9 +1,16 @@ name: Nginx Access id: c716a418-eab3-4df5-9dff-5420174e3068 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Nginx Access +description: Logs HTTP/S access events on an Nginx server, including details such + as client IP, request method, URI, response status, and user agent. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Response Metadata +- Application Log Content +- User Account Metadata source: /var/log/nginx/access.log sourcetype: nginx:plus:kv supported_TA: diff --git a/data_sources/o365.yml b/data_sources/o365.yml index b06665d82c..e3a8fe4084 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -1,9 +1,16 @@ name: O365 id: b32de97d-0074-4cca-853c-db22c392b6c0 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365. +description: Logs management activities in Microsoft 365, including administrative + actions, user activities, and configuration changes across various services. +mitre_components: +- User Account Metadata +- Cloud Service Modification +- Application Log Content +- Configuration Modification +- Active Directory Object Modification source: o365 sourcetype: o365:management:activity separator: Operation diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 09275b6a53..b423cfb188 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -1,12 +1,19 @@ name: O365 Add app role assignment grant to user. id: ce1d7849-a1d2-47fd-b6eb-d7ef854a860c -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add app role assignment grant to user. +description: Logs the assignment of an application role grant to a user in Microsoft + 365, including details about the role, user, and application involved. +mitre_components: +- User Account Modification +- Group Modification +- Cloud Service Modification +- Cloud Service Metadata source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 15e777bb8f..f701f5d05a 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -1,12 +1,20 @@ name: O365 Add app role assignment to service principal. id: 785ba57a-ba7b-474e-97c8-9474e6e00b3a -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add app role assignment to service principal. +description: Logs the assignment of an application role to a service principal in + Microsoft 365, including details about the role, service principal, and application + involved. +mitre_components: +- Cloud Service Modification +- Cloud Service Metadata +- User Account Metadata +- Group Modification source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 20b3dad00a..73d8a6a770 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -1,12 +1,20 @@ name: O365 Add-MailboxPermission id: 9c0babdb-bb15-449e-abba-0a9cdb3fc061 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add-MailboxPermission +description: Logs the addition of mailbox permissions in Microsoft 365, including + details about the mailbox, granted permissions, and the user or administrator performing + the action. +mitre_components: +- User Account Modification +- User Account Metadata +- Active Directory Object Modification +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index c5062b29cf..4bbd0ee8ac 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -1,12 +1,19 @@ name: O365 Add member to role. id: 8b949f7c-4b5d-404f-9694-d7403c4ec096 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add member to role. +description: Logs the addition of a member to a role in Microsoft 365, including details + about the role, the added member, and the user or administrator performing the action. +mitre_components: +- Group Modification +- Group Metadata +- User Account Metadata +- Cloud Service Modification source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index ace4a4d498..b1da0c1792 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -1,12 +1,20 @@ name: O365 Add owner to application. id: da012cbf-af6e-40ee-a1ba-32a5f8da8f8a -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add owner to application. +description: Logs the addition of an owner to an application in Microsoft 365, including + details about the application, the new owner, and the user or administrator performing + the action. +mitre_components: +- User Account Modification +- Group Modification +- Cloud Service Modification +- Cloud Service Metadata source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 15de07e91e..b348c73689 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -1,12 +1,19 @@ name: O365 Add service principal. id: 9c1ef9f5-bc30-4a47-a1bd-cb34484ee778 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Add service principal. +description: Logs the addition of a new service principal in Microsoft 365, including + details about the associated application and the action initiator. +mitre_components: +- Cloud Service Creation +- Cloud Service Metadata +- User Account Metadata +- Active Directory Object Creation source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 64819e33f5..9204dca910 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -1,12 +1,19 @@ name: O365 Change user license. id: 1029a20d-3d0d-4fb9-b5e2-22ac5380b20a -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Change user license. +description: Logs changes to user licenses in Microsoft 365, including additions, + removals, or updates to service plans associated with a user account. +mitre_components: +- User Account Modification +- User Account Metadata +- Cloud Service Modification +- Configuration Modification source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index c26fb96c4f..4d59dd7c64 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -1,12 +1,20 @@ name: O365 Consent to application. id: 0a15a464-ef51-4614-9a07-a216eb9817db -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Consent to application. +description: Logs user or administrator consent to an application's permissions in + Microsoft 365, including details about the application, granted permissions, and + the consenting user or process. +mitre_components: +- User Account Modification +- Cloud Service Modification +- Cloud Service Metadata +- Configuration Modification source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index fa1833e33f..944e7c4ff0 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -1,12 +1,20 @@ name: O365 Disable Strong Authentication. id: 235381c4-382a-4183-b818-a51c3ce12187 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Disable Strong Authentication. +description: Logs the disabling of strong authentication (e.g., multi-factor authentication) + for a user or group in Microsoft 365, including details about the affected accounts + and the action initiator. +mitre_components: +- User Account Modification +- Group Modification +- Configuration Modification +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 6abca5126f..af01ef1644 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -1,12 +1,19 @@ name: O365 MailItemsAccessed id: 3d5188eb-341a-4b46-9caa-aade4047d027 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 MailItemsAccessed +description: Logs access to mailbox items in Microsoft 365, including details about + the user accessing the items, the accessed content, and the method of access. +mitre_components: +- File Access +- User Account Metadata +- Application Log Content +- Active Directory Object Access source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 6d6fde04f6..b6465a9bea 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -1,12 +1,19 @@ name: O365 ModifyFolderPermissions id: 0a8c1080-68c2-46d7-8324-2e7d97bb6e2f -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 ModifyFolderPermissions +description: Logs modifications to folder permissions in Microsoft 365, including + updates to access levels, user assignments, and sharing settings. +mitre_components: +- User Account Modification +- File Access +- Active Directory Object Modification +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index 27041a659a..c5ac97c494 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -1,12 +1,19 @@ name: O365 Set Company Information. id: 06c6d576-f032-41e3-b15d-80a434ce13d8 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Set Company Information. +description: Logs updates to organizational settings and company information in Microsoft + 365, including changes to contact details, branding, and configuration policies. +mitre_components: +- Cloud Service Modification +- Configuration Modification +- Cloud Service Metadata +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 6a8b3379e3..2c33be1f56 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -1,12 +1,19 @@ name: O365 Set-Mailbox id: db798c5c-928c-4972-bb42-e5f90e35865f -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Set-Mailbox +description: Logs changes to mailbox properties in Microsoft 365, including updates + to permissions, storage quotas, and configuration settings. +mitre_components: +- User Account Modification +- Active Directory Object Modification +- User Account Metadata +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 1e19e27c68..10364b65b8 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -1,12 +1,19 @@ name: O365 Update application. id: 62159133-911b-4c63-9e30-a6a8c89195ca -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Update application. +description: Logs updates made to applications in Microsoft 365, including changes + to configurations, permissions, and role assignments. +mitre_components: +- Cloud Service Modification +- Configuration Modification +- Cloud Service Metadata +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 7e6c7a1a5b..44330b89de 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -1,12 +1,19 @@ name: O365 Update authorization policy. id: d40e6a20-4d64-404c-8351-2caae8228d34 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Update authorization policy. +description: Logs changes to authorization policies in Microsoft 365, including updates + to access controls, permissions, and security settings. +mitre_components: +- Cloud Service Modification +- Configuration Modification +- User Account Metadata +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index dd714c9be5..4ab158dedb 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -1,12 +1,19 @@ name: O365 Update user. id: a05fd01e-34d9-4233-9089-11272416b531 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 Update user. +description: Logs updates to user account properties in Microsoft 365, including changes + to roles, permissions, and profile information. +mitre_components: +- User Account Modification +- User Account Metadata +- Active Directory Object Modification +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 299a4a06d6..0bbcff893a 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -1,12 +1,19 @@ name: O365 UserLoggedIn id: ed29c8c4-4053-419c-b133-16abf2a1c4c9 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 UserLoggedIn +description: Logs successful login events by users in Microsoft 365, including details + about the user account, IP address, and session metadata. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata +- Logon Session Metadata source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index f35e8c695e..861b4b18ca 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -1,12 +1,19 @@ name: O365 UserLoginFailed id: 6099b33d-d581-43ed-8401-911862590361 -version: 1 -date: "2024-07-18" +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for O365 UserLoginFailed +description: Logs failed login attempts by users in Microsoft 365, including details + about the user account, IP address, and reason for failure. +mitre_components: +- User Account Authentication +- Logon Session Metadata +- User Account Metadata +- Application Log Content source: o365 sourcetype: o365:management:activity separator: Operation +separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 816d155e23..3d83e462b9 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -1,9 +1,16 @@ name: Okta id: ec26febe-e760-4981-bbee-72e107c7b9d2 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Okta +description: Logs authentication and administrative activities captured by Okta, including + user login attempts, session management, and configuration changes. +mitre_components: +- User Account Authentication +- Logon Session Creation +- User Account Metadata +- Configuration Modification +- Application Log Content source: Okta sourcetype: OktaIM2:log supported_TA: diff --git a/data_sources/osquery.yml b/data_sources/osquery.yml index 7244b5e8ce..b14df40563 100644 --- a/data_sources/osquery.yml +++ b/data_sources/osquery.yml @@ -1,9 +1,16 @@ name: osquery id: 7ec4d7c8-c1d0-423a-9169-261f6adb74c0 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for osquery +description: Logs system queries performed using osquery, including details about + processes, file access, network activity, and system configurations. +mitre_components: +- Process Metadata +- File Access +- Network Traffic Content +- Host Status +- Application Log Content source: osquery sourcetype: osquery:results supported_TA: [] diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 099bea77af..be5d270e69 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -1,9 +1,16 @@ name: Palo Alto Network Threat id: 375c2b0e-d216-41ad-9406-200464595209 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Palo Alto Network Threat +description: Logs detected threats identified by Palo Alto Networks devices, including + details about malware, intrusion attempts, and malicious network activity. +mitre_components: +- Malware Metadata +- Network Traffic Content +- Network Traffic Flow +- Application Log Content +- Host Status source: pan:threat sourcetype: pan:threat supported_TA: diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 3bf554cb8c..7477b93f66 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -1,9 +1,16 @@ name: Palo Alto Network Traffic id: 182a83bc-c31a-4817-8c7a-263744cec52a -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Palo Alto Network Traffic +description: Logs network traffic events captured by Palo Alto Networks devices, including + details about sessions, protocols, and source and destination IPs. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Network Connection Creation +- Response Metadata +- Application Log Content source: screenconnect_palo_traffic sourcetype: pan:traffic supported_TA: diff --git a/data_sources/pingid.yml b/data_sources/pingid.yml index 1342a8c5d5..bde7518b61 100644 --- a/data_sources/pingid.yml +++ b/data_sources/pingid.yml @@ -1,9 +1,16 @@ name: PingID id: 17890675-61c1-40bd-a88e-6a8e9e246b43 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for PingID +description: Logs authentication and multi-factor authentication (MFA) events managed + by PingID, including user logins, device enrollments, and MFA challenges. +mitre_components: +- User Account Authentication +- Logon Session Metadata +- User Account Metadata +- Application Log Content +- Host Status source: XmlWinEventLog:Security sourcetype: XmlWinEventLog supported_TA: [] diff --git a/data_sources/powershell_installed_iis_modules.yml b/data_sources/powershell_installed_iis_modules.yml index a27822830a..ddb49cbdf7 100644 --- a/data_sources/powershell_installed_iis_modules.yml +++ b/data_sources/powershell_installed_iis_modules.yml @@ -1,9 +1,15 @@ name: Powershell Installed IIS Modules id: 4f2ccf42-3503-4417-a684-bfccf7f0d7b4 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Powershell Installed IIS Modules +description: Logs the list of installed IIS modules retrieved using PowerShell, including + details about their names and statuses. +mitre_components: +- Service Metadata +- Configuration Modification +- OS API Execution +- Application Log Content source: powershell://AppCmdModules sourcetype: Pwsh:InstalledIISModules supported_TA: [] diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 8333b3c4b2..a92378edf7 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -1,11 +1,20 @@ name: Powershell Script Block Logging 4104 id: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Powershell Script Block Logging 4104 +description: Logs detailed content of PowerShell script blocks as they are executed, + including the full command text and context for the execution. +mitre_components: +- Script Execution +- Command Execution +- Process Metadata +- OS API Execution +- Application Log Content source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: xmlwineventlog +separator: EventID +separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/powershell_sip_inventory.yml b/data_sources/powershell_sip_inventory.yml index dc02c04217..884298d261 100644 --- a/data_sources/powershell_sip_inventory.yml +++ b/data_sources/powershell_sip_inventory.yml @@ -1,9 +1,15 @@ name: Powershell SIP Inventory id: 5ef5cb5d-1fa8-4567-b48f-27317662cd73 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Powershell SIP Inventory +description: Logs the inventory of System Integrity Policies (SIP) on a system retrieved + via PowerShell, including details about policy configurations and statuses. +mitre_components: +- Configuration Modification +- Host Status +- Application Log Content +- OS API Execution source: powershell://SubjectInterfacePackage sourcetype: PwSh:SubjectInterfacePackage supported_TA: [] diff --git a/data_sources/splunk.yml b/data_sources/splunk.yml index 59728f1060..3358a2e210 100644 --- a/data_sources/splunk.yml +++ b/data_sources/splunk.yml @@ -1,9 +1,16 @@ name: Splunk id: d8a2c791-460b-4756-a8e5-ecade77b21e3 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Splunk +description: Logs user interface access events for Splunk, including details about + user actions, accessed resources, and authentication information. +mitre_components: +- User Account Authentication +- User Account Metadata +- Application Log Content +- Configuration Modification +- Logon Session Metadata source: splunkd_ui_access.log sourcetype: splunkd_ui_access supported_TA: [] diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29db818262..f099678d49 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -1,9 +1,16 @@ name: Splunk Stream HTTP id: b0070a33-92ed-49e5-8f38-576cdf300710 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Splunk Stream HTTP +description: Logs HTTP traffic captured by Splunk Stream, including details such as + request methods, URLs, headers, response codes, and client-server interactions. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Response Content +- Response Metadata +- Application Log Content source: stream:http sourcetype: stream:http supported_TA: diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index d722002f17..ec1c7a15fb 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -1,9 +1,16 @@ name: Splunk Stream IP id: c96f5906-f601-4f32-a26c-482535159bc2 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Splunk Stream IP +description: Logs IP traffic captured by Splunk Stream, including details about source + and destination IPs, protocols, and packet metadata. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Network Connection Creation +- Response Metadata +- Application Log Content source: stream:ip sourcetype: stream:ip supported_TA: diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index 685c0f6931..f9de165e7c 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -1,9 +1,16 @@ name: Splunk Stream TCP id: 4b1233d1-f80a-4da1-ab27-a5b10ea8a4ce -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Splunk Stream TCP +description: Logs TCP traffic captured by Splunk Stream, including details about source + and destination IPs, ports, connection states, and packet-level metadata. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Network Connection Creation +- Response Metadata +- Application Log Content source: stream:tcp sourcetype: stream:tcp supported_TA: diff --git a/data_sources/suricata.yml b/data_sources/suricata.yml index 1c42186cd7..042c8b3a36 100644 --- a/data_sources/suricata.yml +++ b/data_sources/suricata.yml @@ -1,9 +1,16 @@ name: Suricata id: 64b245d4-a4d1-4865-a718-c83d3b939f2e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Suricata +description: Logs network traffic and security events detected by Suricata, including + details about connections, protocol metadata, and potential threats. +mitre_components: +- Network Traffic Content +- Network Traffic Flow +- Network Connection Creation +- Malware Metadata +- Application Log Content source: suricata sourcetype: suricata supported_TA: diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index 86151265da..82abab53f8 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 1 id: b375f4d1-d7ca-4bc0-9103-294825c0af17 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 1 +description: Logs the creation of a new process, including details such as process + ID, parent process, command line arguments, and hashes of the executable. +mitre_components: +- Process Creation +- Process Metadata +- Command Execution +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '1' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon @@ -150,23 +157,22 @@ convert_to_log_source: User: UserSid ParentProcessId: ParentProcessId ParentImage: ParentBaseFileName -example_log: "154100x80000000000000004522Microsoft-Windows-Sysmon/Operationalwin-dc-6764986.attackrange.local-2020-10-08\ - \ 11:03:46.615{96128EA2-F212-5F7E-E400-000000007F01}2296C:\\Windows\\System32\\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows\ - \ Command ProcessorMicrosoft\xAE Windows\xAE Operating\ - \ SystemMicrosoft CorporationCmd.Exe\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam\ - \ %%temp%%\\sam & reg save HKLM\\system %%temp%%\\system & reg save HKLM\\\ - security %%temp%%\\security\" C:\\Users\\ADMINI~1\\\ - AppData\\Local\\Temp\\ATTACKRANGE\\Administrator{96128EA2-F210-5F7E-ACD4-080000000000}0x8d4ac0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{96128EA2-F211-5F7E-DF00-000000007F01}4624C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==" +example_log: 154100x80000000000000004522Microsoft-Windows-Sysmon/Operationalwin-dc-6764986.attackrange.local-2020-10-08 + 11:03:46.615{96128EA2-F212-5F7E-E400-000000007F01}2296C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows + Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %%temp%%\sam + & reg save HKLM\system %%temp%%\system & reg save HKLM\security %%temp%%\security" + C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{96128EA2-F210-5F7E-ACD4-080000000000}0x8d4ac0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{96128EA2-F211-5F7E-DF00-000000007F01}4624C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index be7121e719..8afd1accf9 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 10 +description: Logs events where one process accesses another process, typically for + memory reads or injections, including details about the source and target processes. +mitre_components: +- Process Access +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '10' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 6d271659f5..dc1c00aa6c 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 11 id: f3db9179-f4f5-416d-bc03-39f4d4ff699e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 11 +description: Logs the creation of a new file, including details about the file path, + hash information, and associated process metadata. +mitre_components: +- File Creation +- File Metadata +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '11' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index f1ba265850..d7253a27ee 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 12 id: 3ef28798-8eaa-4fd2-b074-6f36d08a1b33 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 12 +description: Logs the creation of a new registry key, including details about the + key name, registry path, and associated process metadata. +mitre_components: +- Windows Registry Key Creation +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '12' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index ca5391357d..fa07a786fd 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 13 id: 19cd00ee-f65f-48ca-bb08-64aac28638ce -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 13 +description: Logs changes to a registry key, including details about the modified + key, value, and associated process. +mitre_components: +- Windows Registry Key Modification +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '13' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 335042f192..c819cb661e 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 15 +description: Logs the creation of a new file stream, including details about the file + stream's hash, path, and associated process metadata. +mitre_components: +- File Creation +- File Metadata +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '15' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index b1125bf4d3..efb671d8c5 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -1,12 +1,15 @@ name: Sysmon EventID 17 id: 08924246-c8e8-4c95-a9fc-633c43cc82df -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 17 +description: Sysmon EventID 17 logs details about the detection of a named pipe. +mitre_components: +- Named Pipe Metadata source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '17' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index a1204b64f7..8447f15541 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 18 id: 37eb3554-214e-4e66-af10-c3ffc5b8ca82 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 18 +description: Logs the connection to a named pipe, including details about the pipe + name, source and destination processes, and communication direction. +mitre_components: +- Named Pipe Metadata +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '18' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index dfcc795a12..3ea5d1f3f9 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -1,9 +1,15 @@ name: Sysmon EventID 20 id: aeee5374-3203-4286-b744-a8cc4ad1cd7e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 20 +description: Logs WMI (Windows Management Instrumentation) consumer activity, including + details about the WMI event consumer, associated process, and event data. +mitre_components: +- WMI Creation +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index 89de93b9dc..7cc11830ee 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 21 id: 304384bc-715e-4958-988b-a8051a91349a -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 21 +description: Logs activity related to the association of a WMI event consumer with + a filter, including details about the consumer, filter, and associated process. +mitre_components: +- WMI Creation +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '21' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 898d750136..fffc3f518a 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 22 +description: Logs DNS query events, including details about the queried domain, source + IP, query type, and response data. +mitre_components: +- Passive DNS +- Active DNS +- Network Traffic Content +- Network Traffic Flow +- Application Log Content source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '22' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index ee91eb49d2..7e148df04e 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 23 id: 5ea2721d-f60c-4f48-a047-47d514e327c3 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 23 +description: Logs the deletion of a file, including details about the file path, associated + process, and the time of deletion. +mitre_components: +- File Deletion +- File Metadata +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '23' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 4a92e3fcd3..04af350bfd 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 3 id: 01d84dff-4e26-422c-9389-6a579ee6e75b -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 3 +description: Logs details of network connections initiated by processes, including + source and destination IPs, ports, protocols, and the associated process metadata. +mitre_components: +- Network Connection Creation +- Network Traffic Flow +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '3' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index 2e8f6f0ab7..7b8abba8e9 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 5 id: 556471bf-44fa-44e6-97e2-eb25416aeb6d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 5 +description: Logs the termination of a process, including details about the process + name, process ID, parent process, and associated metadata. +mitre_components: +- Process Termination +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '5' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 33345ac58b..053de2de1d 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 6 id: eadc297a-c20c-45a1-8fac-74ad54019767 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 6 +description: Logs the loading of a driver into the kernel or user mode, including + details about the driver name, file path, and associated process metadata. +mitre_components: +- Driver Load +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '6' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 2efd35e16d..8a67c2fab7 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 7 id: 45512fa5-4d55-4088-9d51-f4dedc16fdff -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 7 +description: Logs the loading of an image (module) into a process, including details + about the image name, file path, and hash information. +mitre_components: +- Module Load +- Process Metadata +- File Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '7' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 5fc772500d..1ee7641643 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -1,12 +1,19 @@ name: Sysmon EventID 8 id: df7a786c-ade0-48f0-8596-26f10d169f7d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 8 +description: Logs the creation of a new thread in a process, including details about + the thread ID, start address, and source process. +mitre_components: +- Process Modification +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '8' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index b93f6051cb..f73b040876 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -1,12 +1,20 @@ name: Sysmon EventID 9 id: ae4a6a24-9b8c-4386-a7ac-677d7ad5bf09 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon EventID 9 +description: Logs the access of raw disk data by a process, including details about + the disk name, process ID, and process metadata. +mitre_components: +- Drive Access +- File Metadata +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +separator_value: '9' configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon diff --git a/data_sources/sysmon_for_linux_eventid_1.yml b/data_sources/sysmon_for_linux_eventid_1.yml index 141c94705c..d8a01f3d5d 100644 --- a/data_sources/sysmon_for_linux_eventid_1.yml +++ b/data_sources/sysmon_for_linux_eventid_1.yml @@ -1,12 +1,20 @@ name: Sysmon for Linux EventID 1 id: 93643652-30fe-4941-a1f7-6454f2948660 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon for Linux EventID 1 +description: Logs process creation events on Linux systems, including details about + the process name, process ID, command line arguments, and parent process ID. +mitre_components: +- Process Creation +- Command Execution +- Process Metadata +- OS API Execution +- Application Log Content source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux separator: EventID +separator_value: '1' supported_TA: - name: Splunk Add-on for Sysmon for Linux url: https://splunkbase.splunk.com/app/6652 diff --git a/data_sources/sysmon_for_linux_eventid_11.yml b/data_sources/sysmon_for_linux_eventid_11.yml index f4b6446395..d97cb7d6e0 100644 --- a/data_sources/sysmon_for_linux_eventid_11.yml +++ b/data_sources/sysmon_for_linux_eventid_11.yml @@ -1,9 +1,16 @@ name: Sysmon for Linux EventID 11 id: 14672fed-235a-411f-8062-ace9696fb2af -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Sysmon for Linux EventID 11 +description: Logs the creation of a new file on a Linux system, including details + about the file path, file type, and associated process. +mitre_components: +- File Creation +- File Metadata +- Process Metadata +- OS API Execution +- Application Log Content source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux separator: EventID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index cfeb4c831e..cb22e42655 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -1,9 +1,16 @@ name: Windows Active Directory Admon id: 22bbf4e4-d313-43c1-98ee-808b8775519d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Active Directory Admon +description: Logs administrative actions within Active Directory, including user and + group modifications, permission changes, and policy updates. +mitre_components: +- Active Directory Object Modification +- Group Modification +- User Account Modification +- Configuration Modification +- Application Log Content source: ActiveDirectory sourcetype: ActiveDirectory supported_TA: diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml index 83a470bf4b..9d3269c287 100644 --- a/data_sources/windows_defender_alerts.yml +++ b/data_sources/windows_defender_alerts.yml @@ -1,67 +1,79 @@ name: Windows Defender Alerts id: 91738e9e-d112-41c9-b91b-e5868d8993d7 -version: 1 -date: '2024-09-24' +version: 2 +date: '2025-01-23' author: Gowthamaraj Rajendran -description: Data source object for Windows Defender alerts +description: Logs security alerts generated by Windows Defender, including details + about detected threats, impacted files, and recommended actions for remediation. +mitre_components: +- Malware Metadata +- File Access +- Process Metadata +- Application Log Content +- Host Status source: eventhub://windowsdefenderlogs sourcetype: mscs:azure:eventhub:defender:advancedhunting separator: AlertId supported_TA: - - name: Splunk add on for Microsoft Defender Advanced Hunting - url: https://splunkbase.splunk.com/app/5518 - version: 1.4.1 +- name: Splunk add on for Microsoft Defender Advanced Hunting + url: https://splunkbase.splunk.com/app/5518 + version: 1.4.1 fields: - - _time - - AlertId - - TenantId - - OperationName - - Category - - Timestamp - - EntityType - - EvidenceRole - - SHA1 - - SHA256 - - RemoteIP - - LocalIP - - RemoteUrl - - AccountName - - AccountDomain - - AccountSid - - AccountObjectId - - DeviceId - - ThreatFamily - - EvidenceDirection - - AdditionalFields - - MachineGroup - - NetworkMessageId - - ServiceSource - - FileName - - FolderPath - - ProcessCommandLine - - EmailSubject - - ApplicationId - - Application - - DeviceName - - FileSize - - RegistryKey - - RegistryValueName - - RegistryValueData - - AccountUpn - - OAuthApplicationId - - Categories - - Title - - AttackTechniques - - DetectionSource - - Severity -example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", - "category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", - "EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null, - "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null, - "ThreatFamily": null, "EvidenceDirection": null, "AdditionalFields": "{\"ResourceId\":\"/subscriptions/1-2-3-4/resourceGroups/pluginframework/ - providers/Microsoft.Compute/virtualMachines/phantom-identity\",\"ResourceType\":\"Virtual Machine\",\"ResourceName\":\"phantom-identity\",\"Asset\":true,\" - Type\":\"azure-resource\",\"Role\":0,\"MergeByKey\":\"abcd=\",\"MergeByKeyHex\":\"1234\"}", "MachineGroup": null, "NetworkMessageId": null, "ServiceSource": - "Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application": - null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId": - null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers", - "Severity": "High"}, "Tenant": "DefaultTenant"}' +- _time +- AlertId +- TenantId +- OperationName +- Category +- Timestamp +- EntityType +- EvidenceRole +- SHA1 +- SHA256 +- RemoteIP +- LocalIP +- RemoteUrl +- AccountName +- AccountDomain +- AccountSid +- AccountObjectId +- DeviceId +- ThreatFamily +- EvidenceDirection +- AdditionalFields +- MachineGroup +- NetworkMessageId +- ServiceSource +- FileName +- FolderPath +- ProcessCommandLine +- EmailSubject +- ApplicationId +- Application +- DeviceName +- FileSize +- RegistryKey +- RegistryValueName +- RegistryValueData +- AccountUpn +- OAuthApplicationId +- Categories +- Title +- AttackTechniques +- DetectionSource +- Severity +example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", + "operationName": "Publish", "category": "AdvancedHunting-AlertEvidence", "properties": + {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", "EntityType": "CloudResource", + "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": + null, "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": + null, "AccountObjectId": null, "DeviceId": null, "ThreatFamily": null, "EvidenceDirection": + null, "AdditionalFields": "{\"ResourceId\":\"/subscriptions/1-2-3-4/resourceGroups/pluginframework/ + providers/Microsoft.Compute/virtualMachines/phantom-identity\",\"ResourceType\":\"Virtual + Machine\",\"ResourceName\":\"phantom-identity\",\"Asset\":true,\" Type\":\"azure-resource\",\"Role\":0,\"MergeByKey\":\"abcd=\",\"MergeByKeyHex\":\"1234\"}", + "MachineGroup": null, "NetworkMessageId": null, "ServiceSource": "Microsoft Defender + for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": + null, "ApplicationId": null, "Application": null, "DeviceName": null, "FileSize": + null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, + "AccountUpn": null, "OAuthApplicationId": null, "Categories": "[\"InitialAccess\"]", + "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": + "DefenderForServers", "Severity": "High"}, "Tenant": "DefaultTenant"}' diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index eb6fc6d136..01b723d773 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -1,9 +1,15 @@ name: Windows Event Log Application 2282 id: 4490537e-5e0c-46f7-9209-f56f852aa237 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Application 2282 +description: Logs an event in IIS when a module DLL fails to load due to a configuration + issue, including details about the module and error message. +mitre_components: +- Service Modification +- Configuration Modification +- Application Log Content +- Service Metadata source: XmlWinEventLog:Application sourcetype: XmlWinEventLog separator: EventCode diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 87b847e9bc..8f24d2587e 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -1,12 +1,19 @@ name: Windows Event Log Application 3000 id: 3911945d-9222-408d-b851-9b1bce4c2d24 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Application 3000 +description: Logs the termination of a process, including details about the process, + its termination code, and timestamp. +mitre_components: +- Process Termination +- Process Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Application sourcetype: XmlWinEventLog separator: EventCode +separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index b604bbe548..eb570c28a9 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -1,12 +1,20 @@ name: Windows Event Log CAPI2 70 id: 821de0a6-c5b4-491b-a27e-187552792817 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log CAPI2 70 +description: This event log records events related to cryptographic operations, including + the deletion and export of certificates. +mitre_components: +- Certificate Registration +- Process Metadata +- Application Log Content +- OS API Execution +- Host Status source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational sourcetype: xmlwineventlog separator: EventCode +separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 376d347618..12ef5132b5 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -1,12 +1,20 @@ name: Windows Event Log CAPI2 81 id: 463ff898-8135-4c0e-811e-f8629dfc5027 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log CAPI2 81 +description: Logs an error when attempting to verify the digital signature of a file, + including details about the file path, signature failure, and the process involved. +mitre_components: +- File Access +- File Metadata +- Malware Metadata +- Application Log Content +- Process Metadata source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational sourcetype: xmlwineventlog separator: EventCode +separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index aecc0bf864..f3ba7e5eaa 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -1,12 +1,20 @@ name: Windows Event Log CertificateServicesClient 1007 id: c51444e3-479d-4c4a-b111-e8276a3acf39 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log CertificateServicesClient 1007 +description: Logs the export of a certificate from the local certificate store, including + details about the certificate thumbprint, subject names, and the process involved. +mitre_components: +- Certificate Registration +- Certificate Metadata +- Process Metadata +- Application Log Content +- User Account Metadata source: XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational sourcetype: XmlWinEventLog separator: EventCode +separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e06fcfddca..d24a5e359e 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -1,12 +1,18 @@ name: Windows Event Log Defender 1121 id: 84a254c5-7900-4b52-a324-a176adb7c11d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Defender 1121 +description: Logs an event when a Windows Defender attack surface reduction rule fires + in block mode. +mitre_components: +- Application Log Content +- Host Status +- Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: xmlwineventlog separator: EventCode +separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 669bbb0047..8c16ab4757 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -1,12 +1,18 @@ name: Windows Event Log Defender 1122 id: 4a2d0499-f489-4557-82f4-f357025cf3e7 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Defender 1122 +description: Logs an event when a process attempts to load a DLL that is blocked by + an attack surface reduction rule. +mitre_components: +- Application Log Content +- Process Creation +- Module Load source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: xmlwineventlog separator: EventCode +separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 7cebec3664..41c76a99c0 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -1,12 +1,18 @@ name: Windows Event Log Defender 1129 id: 0572e119-a48a-4c70-bc58-90e453edacd2 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Defender 1129 +description: Logs an event when a user overrides a security policy set by an Attack + Surface Reduction rule in Microsoft Defender. +mitre_components: +- User Account Authentication +- Security Policy Modification +- Application Log Content source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: xmlwineventlog separator: EventCode +separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 598ccc1740..7d43da8579 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -1,9 +1,12 @@ name: Windows Event Log Defender 5007 id: 27f18792-8d95-4871-8853-874b7faf023f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Defender 5007 +description: Logs an event when Windows Defender antimalware settings are modified. +mitre_components: +- Service Modification +- Service Metadata source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: xmlwineventlog separator: EventCode diff --git a/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml index d17981dc1f..c0b00aad8d 100644 --- a/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml +++ b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml @@ -1,9 +1,13 @@ name: Windows Event Log Microsoft Windows TerminalServices RDPClient 1024 id: 2490537e-5e0c-46f7-9209-f56f852aa217 -version: 1 -date: '2024-11-21' +version: 2 +date: '2025-01-23' author: Michael Haag, Splunk -description: Data source object for Windows Event Microsoft Windows TerminalServices RDPClient 1024 +description: Logs an event when a Remote Desktop Protocol (RDP) client successfully + connects to a remote host. +mitre_components: +- Network Connection Creation +- Logon Session Creation source: WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational sourcetype: WinEventLog separator: EventCode @@ -43,19 +47,9 @@ fields: - sourcetype - tag - user -example_log: - 11/21/2024 06:09:16 PM - LogName=Microsoft-Windows-TerminalServices-RDPClient/Operational - EventCode=1024 - EventType=4 - ComputerName=ar-win-5.attackrange.local - User=NOT_TRANSLATED - Sid=S-1-5-21-1731938146-2314223186-1848411941-500 - SidType=0 - SourceName=Microsoft-Windows-TerminalServices-ClientActiveXCore - Type=Information - RecordNumber=95 - Keywords=None - TaskCategory=Connection Sequence - OpCode=This event is raised during the connection process - Message=RDP ClientActiveX is trying to connect to the server (34.221.50.57) \ No newline at end of file +example_log: 11/21/2024 06:09:16 PM LogName=Microsoft-Windows-TerminalServices-RDPClient/Operational + EventCode=1024 EventType=4 ComputerName=ar-win-5.attackrange.local User=NOT_TRANSLATED + Sid=S-1-5-21-1731938146-2314223186-1848411941-500 SidType=0 SourceName=Microsoft-Windows-TerminalServices-ClientActiveXCore + Type=Information RecordNumber=95 Keywords=None TaskCategory=Connection Sequence + OpCode=This event is raised during the connection process Message=RDP ClientActiveX + is trying to connect to the server (34.221.50.57) diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 66896969fe..46e5fea881 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -1,12 +1,16 @@ name: Windows Event Log Printservice 316 id: 12f0be8b-22c0-4fdf-9468-b7ccca824d1d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Printservice 316 +description: Logs an event when printer drivers are installed or updated on the system. +mitre_components: +- Driver Load +- Driver Metadata source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog separator: EventCode +separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index bc9a09f66d..c989e88ce2 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -1,12 +1,18 @@ name: Windows Event Log Printservice 808 id: e3a26785-4389-4830-8d7b-3dad4252719e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Printservice 808 +description: Logs an event when the print spooler service fails to load a printer + plug-in module. +mitre_components: +- Module Load +- Application Log Content +- Service Metadata source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog separator: EventCode +separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 1081028aa2..c3352c16bd 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -1,12 +1,17 @@ name: Windows Event Log RemoteConnectionManager 1149 id: 08f9edb4-f95f-40be-b1dd-bc3a1cd95aaf -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log RemoteConnectionManager 1149 +description: Logs an event when a Remote Desktop Service session is initialized. +mitre_components: +- Network Connection Creation +- Logon Session Creation +- Logon Session Metadata source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational sourcetype: wineventlog separator: EventCode +separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 1e2404f690..1034fc5e50 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 1100 id: 2a25dafa-691e-4cb2-ae59-07a48867ed9a -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 1100 +description: Logs an event when the event logging service has shut down. +mitre_components: +- Host Status +- System Configuration Changes source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 0646f5ad48..b6209e3136 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 1102 id: 8db7b91a-6d7a-40e7-bfac-06f8e901a9cb -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 1102 +description: Logs an event when the audit log is cleared. +mitre_components: +- User Account Modification +- Logon Session Metadata +- File Deletion source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 4f02eeb290..c27cbde9e8 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4624 id: 08682968-0366-4882-9559-fe4fe018a846 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4624 +description: Logs an event when an account successfully logs on to a system. +mitre_components: +- Logon Session Creation +- User Account Authentication +- Logon Session Metadata source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 3928d3b9d6..e37413ca43 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4625 id: 365a02c2-7d18-4baf-b76e-d90c20bbe6ed -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4625 +description: Logs an event when an account fails to log on to a system. +mitre_components: +- User Account Authentication +- Logon Session Metadata source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index dbb7cc5c55..428fea6638 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -1,12 +1,18 @@ name: Windows Event Log Security 4627 id: e35c7b9a-b451-4084-95a5-43b7f8965cac -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4627 +description: Logs an event when a successful account logon occurs and displays the + list of groups the logged-on account belongs to. +mitre_components: +- Logon Session Creation +- Group Metadata +- User Account Authentication source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 26445ed64d..204ee0a6ea 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4648 id: 6a367f8b-1ee0-463d-94a7-029757c6cd02 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4648 +description: Logged when an account logon is attempted by a process by explicitly + specifying the credentials of that account +mitre_components: +- User Account Authentication +- Logon Session Creation source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 1970056294..72241152a5 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4662 id: f3c2cd64-0b5f-4013-8201-35dc03828ec6 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4662 +description: Logs an event when a user accessed an object within the Active Directory, + such as creating, modifying, or deleting it +mitre_components: +- Active Directory Object Access +- Active Directory Object Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 78a84369d9..8464167492 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4663 id: 5d6dca8c-dad9-494f-a321-ef2b0b92fbf4 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4663 +description: Logs an event when a user or process tried to access a file, directory, + registry key, or other system object on the computer +mitre_components: +- File Access +- File Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 69d9996108..c4ae46c0f1 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4672 id: 43f189b6-369d-4a32-a34c-57e0d38d92f1 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4672 +description: Logs an event when a user with administrative privileges logs on to a + system. +mitre_components: +- Logon Session Creation +- User Account Authentication source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 8f0a3e3a57..16b11249c1 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4688 id: d195eb26-a81c-45ed-aeb3-25792e8a985a -version: 2 -date: '2024-09-26' +version: 3 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4688 +description: Logs the creation of a new process +mitre_components: +- Process Creation +- Command Execution source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4688' configuration: Enabling Windows event log process command line logging via group policy object https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_Windows_event_log_process_command_line_logging_via_group_policy_object supported_TA: diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 0aa1b8ab6a..b8c7911455 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4698 id: 32c06703-02d3-47ec-8856-b0dc3045866c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4698 +description: Logs an event when a new scheduled task is created +mitre_components: +- Scheduled Job Creation +- Scheduled Job Metadata source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a0184e87ef..7f05064a8f 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4699 id: 4727dead-d063-4333-9ddd-59823a416aff -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4699 +description: Logs an event when a scheduled task is deleted from the system. +mitre_components: +- Scheduled Job Metadata +- Scheduled Job Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 6d914bbc8c..16ea3afc90 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4703 id: e256673b-16e8-4b74-b7aa-9eed6ce67072 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4703 +description: Logs an event when a token right is adjusted on a Windows system. +mitre_components: +- User Account Modification +- Process Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 07f7261f0d..6edde73b99 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4719 id: 954033e6-dd05-4775-a1f2-1f19632f4420 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4719 +description: Logs an event when a system audit policy is modified on a Windows system. +mitre_components: +- Service Modification +- User Account Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index bbed05f0b9..e6bca434f1 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -1,12 +1,15 @@ name: Windows Event Log Security 4720 id: 7ef1c9e5-691b-48c2-811b-eba91d2d2f1d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4720 +description: Logs an event when a new user account is created on a Windows system. +mitre_components: +- User Account Creation source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 1960e64264..ed2d278c99 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4724 id: 117fe51f-93f8-4589-8e8b-c6b7b7154c7d -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4724 +description: Logs an event when an attempt is made to reset an account's password, + whether successful or not. +mitre_components: +- User Account Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 62a49da0e5..5b91ceeb40 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -1,12 +1,15 @@ name: Windows Event Log Security 4725 id: 31fd887d-0d14-44cc-bb64-80063a9f2968 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4725 +description: Logs an event when a user account has been disabled in Active Directory. +mitre_components: +- User Account Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index feb818c007..8ee6b298fd 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -1,12 +1,15 @@ name: Windows Event Log Security 4726 id: 0b56dcd7-0f72-4a05-9226-d6059781737b -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4726 +description: Logs an event when a user account is deleted from Active Directory. +mitre_components: +- User Account Deletion source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 574c3dd7aa..5f312c3965 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4732 id: b0d61c5d-aefe-486a-9152-de45cc10fbb4 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4732 +description: Logs an event when a member is added to a security-enabled local group + on a Windows system. +mitre_components: +- Group Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 7ee6af3b45..b42d8f7fa2 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -1,12 +1,16 @@ name: Windows Event Log Security 4738 id: cb85709b-101e-41a9-bb60-d2108f79dfbd -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4738 +description: Logs an event when a user account's properties, such as permissions or + memberships, are modified on a Windows system. +mitre_components: +- User Account Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 4ac66f85a9..7fb6bdc459 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -1,12 +1,17 @@ name: Windows Event Log Security 4739 id: c1e0442a-8a97-405d-baf2-057c5d68cd9a -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4739 +description: Logs an event when a domain policy, such as account or lockout policy, + is modified in Active Directory or local security settings. +mitre_components: +- Group Modification +- Active Directory Object Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 2d112fb492..2caa69385e 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4741 id: ef87257f-e7d1-4856-abae-097b2cfdcdb4 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4741 +description: Logs the creation of a new computer account in Active Directory, including + details about the account name, domain, and the user performing the action. +mitre_components: +- Active Directory Object Creation +- User Account Metadata +- Application Log Content +- Configuration Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 042c75ef93..34b90b0f8a 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -1,9 +1,15 @@ name: Windows Event Log Security 4742 id: ea830adf-5450-489a-bcdc-fb8d2cbe674c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4742 +description: Logs changes to the properties of a computer account in Active Directory, + including details about the modified attributes and the user performing the action. +mitre_components: +- Active Directory Object Modification +- User Account Metadata +- Application Log Content +- Configuration Modification source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 474534451e..599f027991 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4768 id: 4a5fd6ed-66bd-4f34-bc74-51c00c73c298 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4768 +description: Logs Kerberos pre-authentication requests, including details about the + user account, authentication type, and client IP address. +mitre_components: +- User Account Authentication +- Active Directory Credential Request +- Logon Session Metadata +- User Account Metadata source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index d8694a1dea..518f49f8da 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4769 id: 358d5520-f40b-4fa2-b799-966c030cb731 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4769 +description: Logs Kerberos service ticket requests, including details about the requesting + user, target service, and client IP address. +mitre_components: +- Active Directory Credential Request +- User Account Authentication +- Logon Session Metadata +- User Account Metadata source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index f31e4b50fe..0e18ca2298 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4771 id: 418debbb-adf3-48ec-9efd-59d45f8861e5 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4771 +description: Logs failed Kerberos pre-authentication attempts, including details about + the user account, client IP, and failure reason. +mitre_components: +- User Account Authentication +- Logon Session Metadata +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index e6ea80b2c5..d6581e3afc 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4776 id: 1da9092a-c795-4a26-ace8-d43855524e96 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4776 +description: Logs NTLM authentication attempts, including details about the account + name, authentication status, and the originating workstation. +mitre_components: +- User Account Authentication +- Logon Session Metadata +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index b807a5a1d9..9daa1781ae 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4781 id: 9732ffe7-ebce-4557-865c-1725a0f633cb -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4781 +description: Logs changes made to the name of a computer account, including the old + and new names and the user performing the action. +mitre_components: +- User Account Modification +- User Account Metadata +- Active Directory Object Modification +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index f3ea14b1c1..eae36c7c52 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4794 id: ec7da74f-274a-4bde-aa0e-15c68aca0426 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4794 +description: Logs attempts to set the Directory Services Restore Mode (DSRM) administrator + password, including details about the account name and the user performing the action. +mitre_components: +- User Account Modification +- User Account Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: null supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 0d64c1b297..c0fed04acf 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -1,9 +1,15 @@ name: Windows Event Log Security 4798 id: 29e97f72-eb2e-400e-b0c9-81277547e43b -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4798 +description: Logs an enumeration of local group membership on a system, including + details about the groups queried and the account performing the action. +mitre_components: +- Group Enumeration +- Group Metadata +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 4d978151e4..8d16e695d2 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4876 id: 4a78722a-9cd9-44e8-b010-dffad5c7f170 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4876 +description: Logs the result of a cryptographic operation, including details about + the key, algorithm used, and whether the operation succeeded or failed. +mitre_components: +- Certificate Registration +- User Account Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 3c82a3eb85..a38f31f8cc 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4886 id: c5abd97d-b468-451f-bd65-b4f97efa4ecc -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4886 +description: Logs the deletion of a cryptographic key container, including details + about the key container name and the user performing the action. +mitre_components: +- Certificate Registration +- User Account Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 39f5cbb7cc..4b8188cb5d 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 4887 id: 994c7b19-a623-4231-9818-f00e453b9a75 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 4887 +description: Logs cryptographic operations performed by a Windows system, including + details about the certificate or key used and the operation type. +mitre_components: +- Certificate Registration +- User Account Metadata +- Application Log Content +- OS API Execution source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index 9e685b1960..048eaf46f7 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 5136 id: 7ba3737e-231e-455d-824e-cd077749f835 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 5136 +description: Logs modifications made to an Active Directory object, including details + about the object name, type, and the changes applied. +mitre_components: +- Active Directory Object Modification +- Active Directory Object Access +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index aef4beca13..1aa19af1d7 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 5137 id: 64ed7bb1-9c3c-4355-ac08-b506ec3b053e -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 5137 +description: Logs the creation of a new Active Directory object, including details + about the object name, type, and the user performing the action. +mitre_components: +- Active Directory Object Creation +- Active Directory Object Modification +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 0687f2ebb5..d8c6bd2297 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 5140 id: 93e0ca09-e4b8-4da6-872a-d0127c4d2b22 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 5140 +description: Logs access to a network share, including details about the user, share + path, and the access type. +mitre_components: +- Network Share Access +- File Access +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 07f144b980..d507ac5298 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 5141 id: eafb35fa-f034-4be3-8508-d9173a73c0a1 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 5141 +description: Logs the deletion of an Active Directory object, including details about + the object name, type, and the user performing the action. +mitre_components: +- Active Directory Object Deletion +- Active Directory Object Modification +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1d6560e36e..5346b703d7 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -1,12 +1,19 @@ name: Windows Event Log Security 5145 id: 0746479b-7b82-4d7e-8811-0b35da00f798 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log Security 5145 +description: Logs detailed information about access to a network share, including + the user, share path, accessed file, and access permissions. +mitre_components: +- Network Share Access +- File Access +- User Account Metadata +- Application Log Content source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index d930d69759..e5a0d75f83 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 4720 id: f01d4758-05c8-4ac4-a9a5-33500dd5eb6c -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 4720 +description: Logs the creation of a new user account, including details about the + account name, associated domain, and the account performing the action. +mitre_components: +- User Account Creation +- User Account Metadata +- Active Directory Object Creation +- Application Log Content source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 706432fb4e..b76450a928 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 4726 id: 05e6b2df-b50e-441b-8ac8-565f2e80d62f -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 4726 +description: Logs the deletion of a user account, including details about the account + name, associated domain, and the account performing the action. +mitre_components: +- User Account Deletion +- User Account Metadata +- Active Directory Object Modification +- Application Log Content source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 906b7cd67d..b7d5ada0c2 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 4728 id: 4549f0ac-3df9-4bfb-bea5-1459690c8040 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 4728 +description: Logs the addition of a user to a security-enabled group, including details + about the group name, user account, and associated domain. +mitre_components: +- Group Modification +- Group Metadata +- User Account Metadata +- Active Directory Object Modification source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 2b5c6845fa..c5eade1a31 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 7036 id: a6e9b34f-1507-4fa1-a4ba-684d1b676a34 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 7036 +description: Logs state changes of a Windows service, including details about the + service name and its new state (e.g., started or stopped). +mitre_components: +- Service Metadata +- OS API Execution +- Application Log Content +- Host Status source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 9a669d6262..8c17c4cec7 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 7040 id: 91738e9e-d112-41c9-b91b-e5868d8993d9 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 7040 +description: Logs changes to the start type of a Windows service, including details + about the service name, old start type, and new start type. +mitre_components: +- Service Modification +- Service Metadata +- OS API Execution +- Application Log Content source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 335efef1a8..e019802f0c 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -1,12 +1,19 @@ name: Windows Event Log System 7045 id: 614dedc8-8a14-4393-ba9b-6f093cbcd293 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 7045 +description: Logs the successful installation of a new Windows service, including + details about the service name, executable path, and service type. +mitre_components: +- Service Creation +- Service Metadata +- OS API Execution +- Process Metadata source: XmlWinEventLog:System sourcetype: xmlwineventlog separator: EventCode +separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 979e053f1d..16cec6a1f0 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -1,12 +1,19 @@ name: Windows Event Log TaskScheduler 200 id: f8c777f8-e88a-4bba-ae8a-79b250212f23 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log TaskScheduler 200 +description: Logs the successful registration of a new scheduled task in Windows Task + Scheduler, including task details and configurations. +mitre_components: +- Scheduled Job Creation +- Scheduled Job Metadata +- Service Creation +- OS API Execution source: WinEventLog:Microsoft-Windows-TaskScheduler/Operational sourcetype: wineventlog separator: EventCode +separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a78d2107dd..b1e3d0539e 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -1,9 +1,15 @@ name: Windows IIS id: 469335b3-b6ad-49e2-bbe6-47e15c1464a7 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows IIS +description: Logs changes to IIS server configuration, including updates to settings, + modules, authentication methods, and site bindings. +mitre_components: +- Service Modification +- Cloud Service Modification +- Configuration Modification +- Application Log Content source: IIS:Configuration:Operational sourcetype: IIS:Configuration:Operational separator: EventID diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 7657e0c52c..7eeb8eeb79 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -1,12 +1,19 @@ name: Windows IIS 29 id: 1d99ddd7-7fec-4dea-bf4f-1f4906142328 -version: 1 -date: '2024-07-18' +version: 2 +date: '2025-01-23' author: Patrick Bareiss, Splunk -description: Data source object for Windows IIS 29 +description: Logs modifications to IIS server authentication settings, including updates + to client certificate requirements and authentication methods. +mitre_components: +- Service Modification +- Configuration Modification +- Certificate Registration +- Application Log Content source: IIS:Configuration:Operational sourcetype: IIS:Configuration:Operational separator: EventID +separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml index 9f331adb00..916df22a3a 100644 --- a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml @@ -17,8 +17,8 @@ data_source: - ASL AWS CloudTrail search: '`amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.operation=DeactivateMFADevice) | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by actor.user.uid api.operation actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region - | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent + | stats count min(_time) as firstTime max(_time) as lastTime by actor.user.uid api.operation api.service.name http_request.user_agent src_endpoint.ip actor.user.account.uid cloud.provider cloud.region + | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_multi_factor_authentication_disabled_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. @@ -47,7 +47,7 @@ rba: type: user score: 64 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml index 1f1fd7d422..040277bda5 100644 --- a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml +++ b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml @@ -19,9 +19,8 @@ search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPe | rename requestParameters.launchPermission.add.items{}.group as group_added | rename requestParameters.launchPermission.add.items{}.userId as accounts_added | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public") - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime values(group_added) as group_added values(accounts_added) as accounts_added values(ami_status) as ami_status by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(group_added) as group_added values(accounts_added) as accounts_added values(ami_status) as ami_status by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `aws_ami_attribute_modification_for_exfiltration_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index 9787083dff..694f2a2989 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -17,9 +17,8 @@ data_source: - AWS CloudTrail DescribeEventAggregates search: '`cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" | bin span=5m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(action) as action values(src) as src values(dest) as dest dc(src) as distinct_ip_count by _time user vendor_account vendor_region vendor_product + | rename user_name as user + | stats min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(signature) as signature values(src) as src values(dest) as dest dc(src) as distinct_ip_count by _time user vendor_account vendor_region vendor_product | where distinct_ip_count > 1 | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `aws_concurrent_sessions_from_different_ips_filter`' diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index 6796bcc648..0f5a179514 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -16,9 +16,8 @@ description: The following analytic identifies failed authentication attempts to data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product additionalEventData.MFAUsed errorMessage + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product additionalEventData.MFAUsed errorMessage | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_console_login_failed_during_mfa_challenge_filter`' diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 9742f0ee35..68f5e47739 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -19,9 +19,8 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws. | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | where key_policy_action_1 = "*" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_create_policy_version_to_allow_all_resources_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index d8fb41afe5..f549bef8e2 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -17,9 +17,8 @@ data_source: search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) | search match=0 - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 2acc9beb62..aa3455544e 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -20,10 +20,9 @@ search: '`cloudtrail` eventName = CreateLoginProfile | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userIdentity.userName as new_login_profile - | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip + | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode user_agent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip dest vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] - | rename eventName as action, eventSource as dest, user_arn as user, userAgent as user_agent, src_ip as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" + | rename user_arn as user | `aws_createloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -48,13 +47,13 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: User $user$ is attempting to create a login profile for $new_login_profile$ - and did a console login from this IP $src$ + and did a console login from this IP $src_ip$ risk_objects: - field: user type: user score: 72 threat_objects: - - field: src + - field: src_ip type: ip_address tags: analytic_story: @@ -74,3 +73,5 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail + + \ No newline at end of file diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index ccf26bb80e..8ca873ae73 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -16,9 +16,8 @@ description: The following analytic identifies unsuccessful login attempts to th data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName = ConsoleLogin errorMessage="Failed authentication" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 366d056882..280f2fd046 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -17,9 +17,8 @@ data_source: - AWS CloudTrail GetPasswordData search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime dc(requestParameters.instanceId) as distinct_instance_ids by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime dc(requestParameters.instanceId) as distinct_instance_ids by signature dest user user_agent src vendor_account vendor_region vendor_product | where distinct_instance_ids > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_credential_access_getpassworddata_filter`' @@ -46,8 +45,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ is seen to make mulitple `GetPasswordData` API calls to - instance ids $instance_ids$ from IP $src$ + message: User $user$ is seen to make mulitple `GetPasswordData` API calls to multiple instances from IP $src$ risk_objects: - field: user type: user diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 1a6310fc2f..ce23361a3d 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -16,9 +16,8 @@ description: The following analytic detects the resetting of the master user pas data_source: - AWS CloudTrail ModifyDBInstance search: '`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=* - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_credential_access_rds_password_reset_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml index c2c6adda25..a5d6a1069a 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml @@ -16,9 +16,8 @@ description: The following analytic detects the deletion of AWS CloudTrail logs data_source: - AWS CloudTrail DeleteTrail search: '`cloudtrail` eventName = DeleteTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudtrail_filter`' how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 3308368693..289229b26d 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -16,9 +16,8 @@ description: The following analytic detects the deletion of CloudWatch log group data_source: - AWS CloudTrail DeleteLogGroup search: '`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudwatch_log_group_filter`' how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml index 7dbfa9ad82..ba0d646ecb 100644 --- a/detections/cloud/aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -23,9 +23,8 @@ data_source: - AWS CloudTrail DeleteLoggingConfiguration - AWS CloudTrail DeleteAlarms search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`' how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml index 243134cb17..89a5e96ddd 100644 --- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml +++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml @@ -17,9 +17,8 @@ data_source: search: '`cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success | spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days | spath path=requestParameters{}.bucketName output=bucket_name - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product bucket_name expiration_days + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product bucket_name expiration_days | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_putbucketlifecycle_filter`' how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. We recommend our users to set the expiration days value according diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index 1373c8781b..cdc2bf356b 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -16,9 +16,8 @@ description: The following analytic detects `StopLogging` events in AWS CloudTra data_source: - AWS CloudTrail StopLogging search: '`cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent!=console.amazonaws.com errorCode = success - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_stop_logging_cloudtrail_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index 71a3be13fb..8959939a27 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -16,9 +16,8 @@ description: The following analytic detects `UpdateTrail` events in AWS CloudTra data_source: - AWS CloudTrail UpdateTrail search: '`cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_defense_evasion_update_cloudtrail_filter`' how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index 52c5bb40a6..64417b6060 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -24,9 +24,8 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | eval key_policy_action=mvappend(key_policy_action_1,key_policy_action_2) | spath input=key_policy_statements output=key_policy_principal path=Principal.AWS | search key_policy_action="kms:Encrypt" AND key_policy_principal="*" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product key_policy_action key_policy_principal + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product key_policy_action key_policy_principal | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 9296c2c437..519597fbdc 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product bucketName src_file dest_file + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product bucketName src_file dest_file | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_detect_users_with_kms_keys_performing_encryption_s3_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml index 633072c453..9cf1b782c4 100644 --- a/detections/cloud/aws_disable_bucket_versioning.yml +++ b/detections/cloud/aws_disable_bucket_versioning.yml @@ -15,9 +15,8 @@ description: The following analytic detects when AWS S3 bucket versioning is sus lead to data loss and hinder recovery efforts, severely impacting data integrity and availability. search: '`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region, requestParameters.bucketName as bucket_name - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product bucket_name + | rename user_name as user, requestParameters.bucketName as bucket_name + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product bucket_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_disable_bucket_versioning_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml index b5b351c84d..359d152a38 100644 --- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml +++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml @@ -20,9 +20,8 @@ search: '`cloudtrail` eventName=ModifySnapshotAttribute | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | where match = "No Match" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product requested_account_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ec2_snapshot_shared_externally_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index 3714ddbd98..fd84cd5a47 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -22,9 +22,8 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF | spath input=findings | search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index 106f0ae2ed..c2a4626cf0 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -21,9 +21,8 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF | spath input=findings | search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN") | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 4f7b7f2c14..4bc30f42d7 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -21,9 +21,8 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF | spath input=findings | search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product finding_name finding_description imageDigest repository | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index ec7d22be55..06ffc02b79 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -19,9 +19,8 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour OR date_hour<8 OR date_wday=saturday OR date_wday=sunday | rename requestParameters.* as * | rename repositoryName AS repository - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product repository + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature user user_agent src vendor_account vendor_region vendor_product repository | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index ecf00814e5..6efff0d27f 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -17,9 +17,8 @@ data_source: search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` | rename requestParameters.* as * | rename repositoryName AS image - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product image + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature user user_agent src vendor_account vendor_region vendor_product image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 5451636bfb..437210a221 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | fillnull - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(action) as dc_events min(_time) as firstTime max(_time) as lastTime values(action) as action values(dest) as dest values(user_agent) as user_agent values(src) as src values(vendor_account) as vendor_account values(vendor_region) as vendor_region by user + | rename user_name as user + | stats dc(signature) as dc_events min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(dest) as dest values(user_agent) as user_agent values(src) as src values(vendor_account) as vendor_account values(vendor_region) as vendor_region by user | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This @@ -42,7 +41,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: User $user$ has excessive number of api calls $dc_events$ from these IP - addresses $src$, violating the threshold of 50, using the following actions $action$. + addresses $src$, violating the threshold of 50, using the following actions $signature$. risk_objects: - field: user type: user diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml index ac279b1848..7a7a3777b1 100644 --- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml +++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml @@ -16,9 +16,8 @@ description: The following analytic identifies anomalous GetObject API activity exfiltrate sensitive data, leading to data breaches and compliance violations. search: '`cloudtrail` eventName=GetObject | bin _time span=10m - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count values(requestParameters.bucketName) as bucketName by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count values(requestParameters.bucketName) as bucketName by signature dest user user_agent src vendor_account vendor_region vendor_product | anomalydetection "count" "user" action=annotate | search probable_cause=* |`aws_exfiltration_via_anomalous_getobject_api_activity_filter`' diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index 4b76762dcb..b8d5a7fbd1 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -16,9 +16,8 @@ description: The following analytic identifies the creation of AWS Batch jobs th and loss of sensitive information. search: '`cloudtrail` eventName = JobCreated | fillnull - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_batch_service_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml index 93c4a38b18..4b51afcc02 100644 --- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml +++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml @@ -15,9 +15,8 @@ description: The following analytic detects API calls to enable S3 bucket replic could replicate sensitive data to external accounts, leading to data breaches and compliance violations. search: '`cloudtrail` eventName = PutBucketReplication eventSource = s3.amazonaws.com - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region, requestParameters.bucketName as bucket_name - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product bucket_name + | rename user_name as user, requestParameters.ReplicationConfiguration.Rule.Destination.Bucket as bucket_name + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product bucket_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_bucket_replication_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml index b0e454b109..7d959dccfb 100644 --- a/detections/cloud/aws_exfiltration_via_datasync_task.yml +++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml @@ -16,9 +16,8 @@ description: The following analytic detects the creation of an AWS DataSync task data breaches and compliance violations. search: '`cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com" | rename requestParameters.* as * - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product destinationLocationArn sourceLocationArn + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product destinationLocationArn sourceLocationArn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index 29dcbe0b67..5b182eaf4b 100644 --- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -20,9 +20,8 @@ description: The following analytic detects a series of AWS API calls related to violations. search: '`cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip !="guardduty.amazonaws.com" | bin _time span=5m - | eval vendor_product = "AWS" - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | stats count dc(action) as distinct_api_calls values(action) as action values(dest) as dest values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(user_agent) as user_agent by _time user src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count dc(signature) as distinct_api_calls values(signature) as signature values(dest) as dest values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(user_agent) as user_agent by _time user src vendor_account vendor_region vendor_product | where distinct_api_calls >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_ec2_snapshot_filter`' diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index d9afb8b908..a522509486 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(_raw) AS failed_attempts values(src) as src values(user_agent) as user_agent by _time, user, action, dest, vendor_account vendor_region, vendor_product + | rename user_name as user + | stats dc(_raw) AS failed_attempts values(src) as src values(user_agent) as user_agent by _time, user, signature, dest, vendor_account vendor_region, vendor_product | where failed_attempts > 20 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_high_number_of_failed_authentications_for_user_filter`' diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 80213c5005..ead873137d 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(_raw) AS failed_attempts values(user) as user values(user_agent) as user_agent by _time, src, action, dest, vendor_account vendor_region, vendor_product + | rename user_name as user + | stats dc(_raw) AS failed_attempts values(user) as user values(user_agent) as user_agent by _time, src, signature, dest, vendor_account vendor_region, vendor_product | where failed_attempts > 20 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_high_number_of_failed_authentications_from_ip_filter`' diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index f3f2d7600f..32ebb2a3f9 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(action) as methods, dc(dest) as sources values(action) as action values(dest) as dest by src, user, vendor_account vendor_region, vendor_product + | rename user_name as user + | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(signature) as methods, dc(dest) as sources values(signature) as signature values(dest) as dest by src, user, vendor_account vendor_region, vendor_product | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`' diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 5950c7d510..59362ff946 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -16,9 +16,8 @@ description: The following analytic detects multiple failed attempts to assume a data_source: - AWS CloudTrail search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src, user, vendor_account vendor_region, vendor_product, action, dest, errorCode + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src, user, vendor_account vendor_region, vendor_product, signature, dest, errorCode | where count >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 9a1ff45d95..1144a49768 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -16,9 +16,8 @@ description: The following analytic detects the deletion of an IAM policy in AWS data_source: - AWS CloudTrail DeletePolicy search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs. diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index c2d7f3f6be..72960b4c4d 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -16,9 +16,8 @@ description: The following analytic identifies failed attempts to delete AWS IAM data_source: - AWS CloudTrail DeleteGroup search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs. diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 95b05b3e42..665e28a8f0 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -16,9 +16,8 @@ description: The following analytic identifies the successful deletion of an IAM data_source: - AWS CloudTrail DeleteGroup search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com) - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs. diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml index cead07f377..41391682b0 100644 --- a/detections/cloud/aws_lambda_updatefunctioncode.yml +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -15,9 +15,8 @@ description: The following analytic identifies IAM users attempting to update or data_source: - AWS CloudTrail search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode = success user_type=IAMUser - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_lambda_updatefunctioncode_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml index 89e34fd41d..20be3ffafa 100644 --- a/detections/cloud/aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail DeleteVirtualMFADevice - AWS CloudTrail DeactivateMFADevice search: '`cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice) - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_multi_factor_authentication_disabled_filter`' how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs. diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index 5364cabcce..258579585e 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication" | bucket span=5m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(_raw) as mfa_prompts min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(src) as src by _time user dest action vendor_account vendor_region vendor_product errorMessage + | rename user_name as user + | stats dc(_raw) as mfa_prompts min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(src) as src values(dest) as dest by _time user signature vendor_account vendor_region vendor_product errorMessage | where mfa_prompts > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 8430271670..4ab70632ac 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,9 +17,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(user) AS unique_accounts values(user) as user values(user_agent) as user_agent by _time, src, action, dest, vendor_account, vendor_region, vendor_product + | rename user_name as user + | stats dc(user) AS unique_accounts values(user) as user values(user_agent) as user_agent by _time, src, signature, dest, vendor_account, vendor_region, vendor_product | where unique_accounts>30 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index 53a0b53635..65b3e082ec 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -22,8 +22,8 @@ search: "`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor | eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' | where port_range>1024] | fillnull - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from requestParameters.cidrBlock + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`" how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 1f7c98e312..0fa6db478b 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail DeleteNetworkAclEntry search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false | fillnull - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail @@ -41,8 +40,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ from $src$ has sucessfully deleted network ACLs entry (eventName= - $eventName$), such that the instance is accessible from anywhere + message: User $user$ from $src$ has sucessfully deleted network ACLs entry, such that the instance is accessible from anywhere risk_objects: - field: user type: user diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 9023487963..b7c524e1b0 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -15,9 +15,8 @@ description: The following analytic detects the registration of a new Multi-Fact data_source: - AWS CloudTrail CreateVirtualMFADevice search: '`cloudtrail` eventName=CreateVirtualMFADevice - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region, requestParameters.virtualMFADeviceName as virtualMFADeviceName - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product virtualMFADeviceName + | rename userName as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_new_mfa_method_registered_for_user_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This @@ -44,7 +43,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A new virtual device $virtualMFADeviceName$ is added to user $user$ + message: A new virtual device is added to user $user$ risk_objects: - field: user type: user diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index 441a3eeec2..4795411501 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -18,9 +18,8 @@ data_source: - AWS CloudTrail GetAccountPasswordPolicy - AWS CloudTrail DeleteAccountPasswordPolicy search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 51e9b3ea04..b75e51fa8b 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -16,9 +16,8 @@ description: The following analytic detects updates to the SAML provider in AWS. data_source: - AWS CloudTrail UpdateSAMLProvider search: '`cloudtrail` eventName=UpdateSAMLProvider - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.sAMLProviderArn) as request_parameters by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This @@ -46,7 +45,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: User $user$ from IP address $src$ has trigged - an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ + an event $signature$ to update the SAML provider to $request_parameters$ risk_objects: - field: user type: user diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 5d775a0401..6d5fb033e9 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -15,9 +15,8 @@ description: The following analytic detects when a user sets a default policy ve data_source: - AWS CloudTrail SetDefaultPolicyVersion search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -43,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: From IP address $src$, user $user$ has trigged an action $action$ + message: From IP address $src$, user $user$ has trigged an action $signature$ for updating the the default policy version risk_objects: - field: user diff --git a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml index c159754c61..d7ec66df03 100644 --- a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml +++ b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml @@ -16,9 +16,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName = ConsoleLogin | bin span=5m _time - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats dc(src) as distinct_ip_count values(src) as src values(user_agent) as user_agent by _time, user, action, dest, vendor_account, vendor_region, vendor_product + | rename user_name as user + | stats dc(src) as distinct_ip_count values(src) as src values(user_agent) as user_agent values(dest) as dest by _time, user, signature, vendor_account, vendor_region, vendor_product | where distinct_ip_count>1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_successful_console_authentication_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml index 9f326936db..798789c6c7 100644 --- a/detections/cloud/aws_successful_single_factor_authentication.yml +++ b/detections/cloud/aws_successful_single_factor_authentication.yml @@ -15,9 +15,8 @@ description: The following analytic identifies a successful Console Login authen data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No - | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region - | eval vendor_product = "AWS" - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user user_agent src vendor_account vendor_region vendor_product + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_successful_single_factor_authentication_filter`' how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 81255cca76..4c59fbe732 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -16,7 +16,8 @@ data_source: - AWS CloudTrail ConsoleLogin search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time - | stats dc(_raw) AS distinct_attempts values(user_name) as tried_accounts by _time, src_ip + | stats dc(_raw) AS distinct_attempts values(user_name) as tried_accounts values(action) as action values(dest) as dest + values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(vendor_product) as vendor_product values(user_agent) as user_agent by _time, src | eventstats avg(distinct_attempts) as avg_attempts , stdev(distinct_attempts) as ip_std by _time | eval upperBound=(avg_attempts+ip_std*3) | eval isOutlier=if(distinct_attempts > 10 and distinct_attempts >= upperBound, 1, 0) @@ -47,13 +48,13 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: 'Unusual number of failed console login attempts (Count: $distinct_attempts$) - against users from IP Address - $src_ip$' + against users from IP Address - $src$' risk_objects: - field: tried_accounts type: user score: 54 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index c90f5d742a..50948031d0 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -1,6 +1,6 @@ name: AWS UpdateLoginProfile id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111 -version: 8 +version: 9 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -17,9 +17,10 @@ data_source: - AWS CloudTrail UpdateLoginProfile search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName), - 1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime - by requestParameters.userName src eventName eventSource aws_account_id errorCode - userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` + 1,0) | search match=0 + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -29,12 +30,12 @@ references: - https://bishopfox.com/blog/privilege-escalation-in-aws - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ drilldown_searches: -- name: View the detection results for - "$user_arn$" - search: '%original_detection_search% | search user_arn = "$user_arn$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user_arn$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_arn$") +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -43,11 +44,11 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: From IP address $src$, user agent $userAgent$ has trigged an event $eventName$ - for updating the existing login profile, potentially giving user $user_arn$ more + message: From IP address $src$, user agent $user_agent$ has trigged an event UpdateLoginProfile + for updating the existing login profile, potentially giving user $user$ more access privilleges risk_objects: - - field: user_arn + - field: user type: user score: 30 threat_objects: diff --git a/detections/cloud/o365_email_suspicious_search_behavior.yml b/detections/cloud/o365_email_suspicious_search_behavior.yml new file mode 100644 index 0000000000..f94970bf6b --- /dev/null +++ b/detections/cloud/o365_email_suspicious_search_behavior.yml @@ -0,0 +1,70 @@ +name: O365 Email Suspicious Search Behavior +id: 3b6e1d36-6916-4eec-a7d5-bc98953ba595 +version: 1 +date: '2025-02-27' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a mailbox and is conducting discovery or enumeration activities. +data_source: +- Office 365 Universal Audit Log +search: |- + `o365_management_activity` Operation=SearchQueryInitiatedExchange + | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null()) + | where command != "*" AND command != "(*)" + | bin _time span=1hr + | `o365_email_suspicious_search_behavior_filter` + | stats values(ScenarioName) as app, values(object_name) as object_name values(command) as command, values(suspect_terms) as suspect_terms, values(src) as src, dc(suspect_terms) as suspect_terms_count, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time + | where count > 20 OR suspect_terms_count >= 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must also enable SearchQueryInitiated category as part of your organizations mailbox audit logging policy. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. +known_false_positives: Users searching excessively or possible false positives related to matching conditions. +references: +- https://learn.microsoft.com/en-us/purview/audit-get-started#step-3-enable-searchqueryinitiated-events +- https://www.cisa.gov/sites/default/files/2025-01/microsoft-expanded-cloud-logs-implementation-playbook-508c.pdf +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a +- https://attack.mitre.org/techniques/T1114/002/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate search behavior by $user$ + search: '`o365_management_activity` AND Operation=SearchQueryInitiatedExchange AND UserId = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: The user $user$ searched email suspiciously, $count$ unique terms and $suspect_terms_count$ suspect terms were searched within a limited timeframe. + risk_objects: + - field: user + type: user + score: 35 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - Office 365 Account Takeover + - Office 365 Collection Techniques + - Compromised User Account + - CISA AA22-320A + asset_type: O365 Tenant + mitre_attack_id: + - T1114.002 + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log + source: o365 + sourcetype: o365:management:activity diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index 52449ed52b..87ef5a4414 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -1,26 +1,28 @@ name: O365 SharePoint Suspicious Search Behavior id: 6ca919db-52f3-4c95-a4e9-7b189e8a043d -version: 1 -date: '2025-01-08' +version: 2 +date: '2025-02-27' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when the O365 SharePoint users search for suspicious keywords or have an excessive number of queries within a limited timeframe. This behavior may indicate malicious actor enumeration of SharePoint based data within O365. +description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a SharePoint site within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a user account and is conducting discovery or enumeration activities. data_source: - Office 365 Universal Audit Log search: |- - `o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* - | where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)")) - | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time - | bin _time span=1hr - | stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time - | where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + `o365_management_activity` (Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search*) OR Operation=SearchQueryInitiatedSharepoint + | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null()) + | where command != "*" AND command != "(*)" + | bin _time span=1hr | `o365_sharepoint_suspicious_search_behavior_filter` + | stats values(ScenarioName) as app, values(object_name) as object_name values(command) as command, values(suspect_terms) as suspect_terms, values(src) as src, dc(suspect_terms) as suspect_terms_count, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time + | where count > 20 OR suspect_terms_count >= 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. known_false_positives: Users searching excessively or possible false positives related to matching conditions. references: +- https://learn.microsoft.com/en-us/purview/audit-get-started#step-3-enable-searchqueryinitiated-events +- https://www.cisa.gov/sites/default/files/2025-01/microsoft-expanded-cloud-logs-implementation-playbook-508c.pdf - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a - https://attack.mitre.org/techniques/T1213/002/ drilldown_searches: @@ -33,22 +35,23 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate search behavior by $user$ - search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$"' + search: '`o365_management_activity` (Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$") OR (OR Operation=SearchQueryInitiatedSharepoint AND UserId = "$user$")' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The SharePoint Online was searched suspiciously by $user$ + message: The user $user$ searched SharePoint suspiciously, $count$ unique terms and $suspect_terms_count$ suspect terms were searched within a limited timeframe. risk_objects: - field: user type: user - score: 25 + score: 35 threat_objects: - field: src type: ip_address tags: analytic_story: - - Azure Active Directory Persistence - Office 365 Account Takeover + - Office 365 Collection Techniques + - Compromised User Account - CISA AA22-320A asset_type: O365 Tenant mitre_attack_id: diff --git a/detections/deprecated/.gitkeep b/detections/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index a983aeb31d..b4a9c676c9 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,7 +1,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-02-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,7 +66,6 @@ rba: tags: analytic_story: - XMRig - - Monitor for Unauthorized Software - Unusual Processes - SamSam Ransomware - CISA AA22-264A diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 0b6dcac7d9..d8c602f6b4 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -1,7 +1,7 @@ name: Bcdedit Command Back To Normal Mode Boot id: dc7a8004-0f18-11ec-8c54-acde48001122 -version: 4 -date: '2024-11-13' +version: '5' +date: '2025-03-03' author: Teoderick Contreras, Splunk status: production type: TTP @@ -62,6 +62,7 @@ rba: threat_objects: [] tags: analytic_story: + - Black Basta Ransomware - BlackMatter Ransomware asset_type: Endpoint mitre_attack_id: @@ -74,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 6d8c2aa9ec..75247f707c 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -1,7 +1,7 @@ name: Change To Safe Mode With Network Config id: 81f1dce0-0f18-11ec-a5d7-acde48001122 -version: 4 -date: '2024-11-13' +version: '5' +date: '2025-03-03' author: Teoderick Contreras, Splunk status: production type: TTP @@ -61,6 +61,7 @@ rba: threat_objects: [] tags: analytic_story: + - Black Basta Ransomware - BlackMatter Ransomware asset_type: Endpoint mitre_attack_id: @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index d1f74e3aa8..e2bb113221 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -69,6 +69,7 @@ tags: - SamSam Ransomware - Clop Ransomware - Ryuk Ransomware + - Black Basta Ransomware asset_type: Endpoint mitre_attack_id: - T1485 diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index d9b5027dbd..e796d56dcb 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -37,6 +37,7 @@ tags: - SamSam Ransomware - Clop Ransomware - Ryuk Ransomware + - Black Basta Ransomware asset_type: Endpoint mitre_attack_id: - T1485 diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 92c5868542..0233342813 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -69,18 +69,19 @@ rba: type: process_name tags: analytic_story: - - CISA AA22-264A - - Chaos Ransomware + - Rhysida Ransomware - Prestige Ransomware - - Ransomware + - CISA AA22-264A - LockBit Ransomware + - SamSam Ransomware + - Chaos Ransomware + - Black Basta Ransomware + - DarkGate Malware + - Ransomware + - Windows Log Manipulation + - Compromised Windows Host - Clop Ransomware - Medusa Ransomware - - Compromised Windows Host - - Windows Log Manipulation - - SamSam Ransomware - - DarkGate Malware - - Rhysida Ransomware asset_type: Endpoint mitre_attack_id: - T1490 diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index a36e49cace..d5dae5c8af 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,7 +1,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 7 -date: '2024-11-13' +version: '8' +date: '2025-03-03' author: Michael Haag, Splunk status: production type: TTP @@ -75,6 +75,7 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + - Black Basta Ransomware asset_type: Endpoint mitre_attack_id: - T1020 @@ -86,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 04c0a7e651..8d842c1444 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -1,7 +1,7 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 6 -date: '2024-11-13' +version: '7' +date: '2025-03-03' author: Michael Haag, Splunk status: production type: Hunting @@ -42,6 +42,7 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + - Black Basta Ransomware asset_type: Endpoint mitre_attack_id: - T1020 @@ -53,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 6aca910525..d7b9f60813 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 9 -date: '2025-02-10' +version: '10' +date: '2025-03-03' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -56,9 +56,10 @@ rba: threat_objects: [] tags: analytic_story: - - IcedID - Windows Registry Abuse - CISA AA24-241A + - IcedID + - Black Basta Ransomware asset_type: Endpoint mitre_attack_id: - T1562.001 @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 1fd00e8d98..2e0c1f7cd4 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 11 -date: '2025-02-10' +version: '12' +date: '2025-03-03' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -58,13 +58,14 @@ rba: threat_objects: [] tags: analytic_story: - - Azorult - - Ransomware - - Windows Registry Abuse - - RedLine Stealer - Windows Defense Evasion Tactics - CISA AA23-347A - Revil Ransomware + - Azorult + - Windows Registry Abuse + - Black Basta Ransomware + - Ransomware + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1562.001 @@ -76,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index d42f569018..0fde8612a1 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: '11' -date: '2025-02-24' +version: '12' +date: '2025-02-28' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -101,6 +101,7 @@ tags: - Amadey - SnappyBee - WhisperGate + - SystemBC asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index e51be7f390..fcb014d2a1 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -1,7 +1,7 @@ name: Modification Of Wallpaper id: accb0712-c381-11eb-8e5b-acde48001122 -version: 4 -date: '2024-11-13' +version: '5' +date: '2025-03-03' author: Teoderick Contreras, Splunk status: production type: TTP @@ -54,13 +54,14 @@ rba: threat_objects: [] tags: analytic_story: - - Ransomware - Revil Ransomware - - BlackMatter Ransomware - - Windows Registry Abuse - - Brute Ratel C4 - - LockBit Ransomware - Rhysida Ransomware + - LockBit Ransomware + - BlackMatter Ransomware + - Brute Ratel C4 + - Windows Registry Abuse + - Black Basta Ransomware + - Ransomware asset_type: Endpoint mitre_attack_id: - T1491 @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 1210a1f324..258ffeee7f 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -73,6 +73,7 @@ tags: - DarkGate Malware - Rhysida Ransomware - Malicious PowerShell + - SystemBC asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 8afd39363a..3f642c1daf 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -1,7 +1,7 @@ name: Print Spooler Adding A Printer Driver id: 313681a2-da8e-11eb-adad-acde48001122 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -52,6 +52,7 @@ rba: tags: analytic_story: - PrintNightmare CVE-2021-34527 + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log source: WinEventLog:Microsoft-Windows-PrintService/Operational sourcetype: WinEventLog diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 7ad22f6b32..505ec33faf 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -1,7 +1,7 @@ name: Print Spooler Failed to Load a Plug-in id: 1adc9548-da7c-11eb-8f13-acde48001122 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ rba: tags: analytic_story: - PrintNightmare CVE-2021-34527 + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 77a6329955..a8fdd706d3 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -52,11 +52,12 @@ rba: tags: analytic_story: - BlackMatter Ransomware + - DarkSide Ransomware - Chaos Ransomware - Rhysida Ransomware - LockBit Ransomware - - DarkSide Ransomware - Medusa Ransomware + - Black Basta Ransomware - Clop Ransomware asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 5241399dc0..65ff7b2113 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: '17' -date: '2025-02-24' +version: '18' +date: '2025-02-28' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -76,37 +76,38 @@ rba: threat_objects: [] tags: analytic_story: - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - MoonPeak - Amadey - - RedLine Stealer - - Emotet Malware DHS Report TA18-201A - - Chaos Ransomware - - WinDealer RAT - - Warzone RAT - - China-Nexus Threat Activity - - Earth Estries - - SnappyBee - - Windows Persistence Techniques - - Snake Keylogger - - Ransomware - - CISA AA23-347A - - DHS Report TA18-074A - - Windows Registry Abuse - - Sneaky Active Directory Persistence Tricks - - BlackSuit Ransomware - - Qakbot - - DarkGate Malware - - IcedID - - Braodo Stealer - - Suspicious MSHTA Activity - - NjRAT - AsyncRAT - Azorult - - Suspicious Windows Registry Activities - - Derusbi - BlackByte Ransomware + - BlackSuit Ransomware + - Braodo Stealer + - Chaos Ransomware + - China-Nexus Threat Activity + - CISA AA23-347A + - DarkGate Malware + - Derusbi + - DHS Report TA18-074A + - Earth Estries + - Emotet Malware DHS Report TA18-201A + - IcedID + - MoonPeak + - NjRAT + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + - Qakbot + - Ransomware + - RedLine Stealer - Remcos + - Snake Keylogger + - SnappyBee + - Sneaky Active Directory Persistence Tricks + - Suspicious MSHTA Activity + - Suspicious Windows Registry Activities + - SystemBC + - Warzone RAT + - WinDealer RAT + - Windows Persistence Techniques + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 00822bc0c3..071b4ea163 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,7 +1,7 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 13 -date: '2025-02-10' +version: 14 +date: '2025-02-28' author: Steven Dick, Patrick Bareiss, Splunk status: production type: TTP @@ -77,6 +77,7 @@ tags: - Malicious PowerShell - Data Destruction - DarkGate Malware + - SystemBC asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 70da48f52e..e65d63e295 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -1,7 +1,7 @@ name: Spoolsv Spawning Rundll32 id: 15d905f6-da6b-11eb-ab82-acde48001122 -version: 7 -date: '2025-02-10' +version: '8' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -67,6 +67,7 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 - Compromised Windows Host + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -80,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 07a521d03e..fa3847f8b0 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -50,6 +50,7 @@ rba: tags: analytic_story: - PrintNightmare CVE-2021-34527 + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index a41111a7b1..3b7ec83687 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 -version: 6 -date: '2024-11-13' +version: '7' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -59,6 +59,7 @@ rba: tags: analytic_story: - PrintNightmare CVE-2021-34527 + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 3111e77d23..a8fab8f7b0 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 7 -date: '2025-02-10' +version: '8' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,7 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 - Compromised Windows Host + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -78,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index de8fec23dd..3fce3b68aa 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL - Sysmon id: 347fd388-da87-11eb-836d-acde48001122 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-03-03' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -58,6 +58,7 @@ rba: tags: analytic_story: - PrintNightmare CVE-2021-34527 + - Black Basta Ransomware asset_type: Endpoint cve: - CVE-2021-34527 @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index aa27afdfc7..95fd1c0638 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: '9' -date: '2025-02-24' +version: '11' +date: '2025-03-03' author: Michael Haag, Splunk status: production type: TTP @@ -70,11 +70,12 @@ rba: type: process_name tags: analytic_story: - - Ingress Tool Transfer - China-Nexus Threat Activity + - Ingress Tool Transfer - IcedID - Forest Blizzard - Earth Estries + - Black Basta Ransomware - Compromised Windows Host asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index b43dda9dd5..5b21a81a3f 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -72,6 +72,7 @@ tags: - Swift Slicer - Medusa Ransomware - DarkCrystal RAT + - Black Basta Ransomware - Clop Ransomware asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml b/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml index 9fed3fb897..fde5c9f7ef 100644 --- a/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml +++ b/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml @@ -71,6 +71,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint + manual_test: The risk message is dynamically generated in the SPL and it needs to be manually tested for integration testing. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_sql_server_startup_procedure.yml b/detections/endpoint/windows_sql_server_startup_procedure.yml index f229b0bd3b..ec7dcaeca4 100644 --- a/detections/endpoint/windows_sql_server_startup_procedure.yml +++ b/detections/endpoint/windows_sql_server_startup_procedure.yml @@ -60,6 +60,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint + manual_test: The risk message is dynamically generated in the SPL and it needs to be manually tested for integration testing. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml b/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml index aa9f81c6e3..a99a2646dd 100644 --- a/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml +++ b/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml @@ -72,6 +72,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint + manual_test: The risk message is dynamically generated in the SPL and it needs to be manually tested for integration testing. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index f9a483cc09..07df20b513 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 version: 8 -date: '2025-02-11' +date: '2025-02-28' author: Teoderick Contreras, Splunk status: production type: TTP @@ -103,6 +103,7 @@ tags: - MoonPeak - ValleyRAT - Meduza Stealer + - SystemBC - China-Nexus Threat Activity - Earth Estries - SnappyBee diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 709943bdde..63bc4ad008 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -65,6 +65,7 @@ tags: - Ryuk Ransomware - Winter Vivern - China-Nexus Threat Activity + - SystemBC asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index ebca1eb9ba..15d16577b5 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -71,6 +71,7 @@ tags: - Ryuk Ransomware - Winter Vivern - China-Nexus Threat Activity + - SystemBC asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index f20cf4265e..040059360b 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -1,7 +1,7 @@ name: WinEvent Windows Task Scheduler Event Action Started id: b3632472-310b-11ec-9aab-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-02-28' author: Michael Haag, Splunk status: production type: Hunting @@ -47,6 +47,7 @@ tags: - CISA AA24-241A - BlackSuit Ransomware - ValleyRAT + - SystemBC asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index b50a17a3f6..03e2420676 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -1,7 +1,7 @@ name: Detect Outbound LDAP Traffic id: 5e06e262-d7cd-4216-b2f8-27b437e18458 -version: 4 -date: '2024-11-15' +version: 5 +date: '2025-01-23' author: Bhavin Patel, Johan Bjerke, Splunk status: production type: Hunting @@ -13,7 +13,7 @@ description: The following analytic identifies outbound LDAP traffic to external this to access sensitive directory information, leading to data breaches or further network compromise. data_source: -- Bro +- Palo Alto Network Traffic search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index 94fadd635c..33000d7d6b 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -1,18 +1,18 @@ name: Detect Zerologon via Zeek id: bf7a06ec-f703-11ea-adc1-0242ac120002 -version: 4 -date: '2024-11-15' +version: '5' +date: '2025-03-03' author: Shannon Davis, Splunk status: experimental type: TTP -description: "The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 +description: 'The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability via Zeek RPC. It leverages Zeek DCE-RPC data to identify specific operations: NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3. This activity is significant because it indicates an attempt to gain unauthorized access to a domain controller, potentially leading to a complete takeover of an - organization's IT infrastructure. If confirmed malicious, the impact could be severe, + organization''s IT infrastructure. If confirmed malicious, the impact could be severe, including data theft, ransomware deployment, or other devastating outcomes. Immediate - investigation of the identified IP addresses and RPC operations is crucial." + investigation of the identified IP addresses and RPC operations is crucial.' data_source: [] search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) @@ -40,6 +40,7 @@ tags: analytic_story: - Detect Zerologon Attack - Rhysida Ransomware + - Black Basta Ransomware asset_type: Network cve: - CVE-2020-1472 diff --git a/lookups/deprecation_info.csv b/lookups/deprecation_info.csv new file mode 100644 index 0000000000..743562a38e --- /dev/null +++ b/lookups/deprecation_info.csv @@ -0,0 +1,207 @@ +Name,Content Type,Removed in Version,Reason,Replacement Content,Replacement Content Link +ESCU - Previously Seen AWS Cross Account Activity - Initial,Baseline,5.4.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Cross Account Activity - Update,Baseline,5.4.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - AWS SAML Access by Provider User and Principal - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Actions Disable Security Workflow - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Dependabot Alert - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Pull Request from Unknown User - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Github Commit Changes In Master - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Github Commit In Develop - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Known Services Killed by Ransomware - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote Desktop Network Bruteforce - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Driver Loaded Path - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Event Log Service Behavior - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Process File Path - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect attach to role policy - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect permanent key creation - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect role creation - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect sts assume role abuse - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect sts get session token abuse - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Nexus APT Threat Activity,Story,5.4.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,China-Nexus Threat Activity,https://research.splunk.com/stories/china_nexus_threat_activity +ESCU - Add Prohibited Processes to Enterprise Security,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of API Calls per User ARN,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Monitor Successful Backups,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Monitor Unsuccessful Backups,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Provisioning Activity Sources,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Regions,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 AMIs,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Instance Types,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Launches By User,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Modifications By User,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously seen API call per user roles in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Systems Ready for Spectre-Meltdown Windows Patch,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Update previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - ASL AWS CreateAccessKey - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - ASL AWS Create Access Key - Rule,https://research.splunk.com/cloud/81a9f2fe-1697-473c-af1d-086b0d8b63c8 +ESCU - ASL AWS Excessive Security Scanning - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - ASL AWS Password Policy Changes - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule,https://research.splunk.com/cloud/e7ecc5e0-88df-48b9-91af-51104c68f02f +ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule,https://research.splunk.com/cloud/94994255-3acf-4213-9b3f-0494df03bb31 +ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule,https://research.splunk.com/cloud/f86a8ec9-b042-45eb-92f4-e9ed1d781078 +ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule,https://research.splunk.com/cloud/5aba1860-9617-4af9-b19d-aecac16fe4f2 +ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Kubernetes Abuse of Secret by Unusual Location - Rule,https://research.splunk.com/cloud/40a064c1-4ec1-4381-9e35-61192ba8ef82 +ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Abnormally High AWS Instances Launched by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Instances Launched - Rule,https://research.splunk.com/cloud/f2361e9f-3928-496c-a556-120cd4223a65 +ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Abnormally High AWS Instances Terminated by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule,https://research.splunk.com/cloud/ef629fc9-1583-4590-b62a-f2247fbf7bbf +ESCU - Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that focused on unrelated things and called account discovery. Since there were other detection that overlapped with it. I choose to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 / Windows Excessive Usage Of Net App.",ESCU - Windows Excessive Usage Of Net App - Rule,https://research.splunk.com/endpoint/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Attempt To Stop Security Service - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Attempt To Stop Security Service - Rule,https://research.splunk.com/endpoint/9ed27cea-4e27-4eff-b2c6-aac9e78a7517 +ESCU - Attempted Credential Dump From Registry via Reg exe - Rule,Detection,5.2.0,"This analytic had some overlap with another one, hence the deprecation. It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry Hive Dump Via CommandLine",ESCU - Windows Sensitive Registry Hive Dump Via CommandLine - Rule,https://research.splunk.com/endpoint/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - Change Default File Association - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows New Default File Association Value Set - Rule,https://research.splunk.com/endpoint/7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a +ESCU - Clients Connecting to Multiple DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Cloud Network Access Control List Deleted - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - AWS Network Access Control List Deleted - Rule,https://research.splunk.com/cloud/ada0f478-84a8-4641-a3f1-d82362d6fd75 +ESCU - Cmdline Tool Not Executed In CMD Shell - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Cmdline Tool Execution From Non-Shell Process - Rule,https://research.splunk.com/endpoint/2afa393f-b88d-41b7-9793-623c93a2dfde +ESCU - Correlation by Repository and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,ESCU - Risk Rule for Dev Sec Ops by Repository - Rule,https://research.splunk.com/cloud/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Correlation by User and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,ESCU - Risk Rule for Dev Sec Ops by Repository - Rule,https://research.splunk.com/cloud/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Create local admin accounts using net exe - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Create Local Administrator Account Via Net - Rule,https://research.splunk.com/endpoint/2c568c34-bb57-4b43-9d75-19c605b98e70 +ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - DNS record changed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Deleting Of Net Users - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Deletion Via Net - Rule,https://research.splunk.com/endpoint/b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e +ESCU - Detect API activity from users without MFA - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - AWS Successful Single-Factor Authentication - Rule,https://research.splunk.com/cloud/a520b1fe-cc9e-4f56-b762-18354594c52f +ESCU - Detect AWS API Activities From Unapproved Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Activity Related to Pass the Hash Attacks - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,"As discussed internally, this analytic was too generic for an analyst to do anything with it. It was deprecated in favor of the more specific approach provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender Incident Alerts. Going forward analytics from leveraging alerts from vendors will have their specific analytics.",ESCU - Microsoft Defender ATP Alerts - Rule,https://research.splunk.com/endpoint/38f034ed-1598-46c8-95e8-14edf05fdf5d +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Microsoft Defender Incident Alerts - Rule,https://research.splunk.com/endpoint/13435b55-afd8-46d4-9045-7d5457f430a5 +ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Long DNS TXT Record Response - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Mimikatz Using Loaded Images - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule,https://research.splunk.com/endpoint/8148c29c-c952-11eb-9255-acde48001122 +ESCU - Detect Spike in AWS API Activity - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Spike in Network ACL Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule,https://research.splunk.com/cloud/0840ddf1-8c89-46ff-b730-c8d6722478c0 +ESCU - Detect Spike in Security Group Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule,https://research.splunk.com/cloud/d4dfb7f3-7a37-498a-b5df-f19334e871af +ESCU - Detect USB device insertion - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Webshell Exploit Behavior - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Suspicious Child Process Spawned From WebServer - Rule,https://research.splunk.com/endpoint/2d4470ef-7158-4b47-b68b-1f7f16382156 +ESCU - Detect new API calls from user roles - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud API Calls From Previously Unseen User Roles - Rule,https://research.splunk.com/cloud/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - Detect new user AWS Console Login - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Detect AWS Console Login by New User - Rule,https://research.splunk.com/cloud/bc91a8cd-35e7-4bb2-6140-e756cc46fd71 +ESCU - Detect processes used for System Network Configuration Discovery - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Potential System Network Configuration Discovery Activity - Rule,https://research.splunk.com/endpoint/3f0b95e3-3195-46ac-bea3-84fb59e7fac5 +ESCU - Detect web traffic to dynamic domain providers - Rule,Detection,5.2.0,Updated to use a different log source,ESCU - Detect hosts connecting to dynamic domain providers - Rule,https://research.splunk.com/network/a1e761ac-1344-4dbd-88b2-3f34c912d359 +ESCU - Detection of DNS Tunnels - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Disabling Net User Account - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Disabled Via Net - Rule,https://research.splunk.com/endpoint/b0359e05-c87b-4354-83d8-aee0d890243f +ESCU - Domain Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that looked only for commands that tries to query info about the users via net user /do. This had a couple of issues, such as triggering on creation of users via the /add flag etc.. +It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122",ESCU - Windows User Discovery Via Net - Rule,https://research.splunk.com/endpoint/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - Domain Group Discovery With Net - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Group Discovery Via Net - Rule,https://research.splunk.com/endpoint/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Dump LSASS via procdump Rename - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Dump LSASS via procdump - Rule,https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 +ESCU - EC2 Instance Modified With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud API Calls From Previously Unseen User Roles - Rule,https://research.splunk.com/cloud/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - EC2 Instance Started In Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule,https://research.splunk.com/cloud/fa4089e2-50e3-40f7-8469-d2cc1564ca59 +ESCU - EC2 Instance Started With Previously Unseen AMI - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule,https://research.splunk.com/cloud/bc24922d-987c-4645-b288-f8c73ec194c4 +ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule,https://research.splunk.com/cloud/c6ddbf53-9715-49f3-bb4c-fb2e8a309cda +ESCU - EC2 Instance Started With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule,https://research.splunk.com/cloud/37a0ec8d-827e-4d6d-8025-cedf31f3a149 +ESCU - Elevated Group Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Sensitive Group Discovery With Net - Rule,https://research.splunk.com/endpoint/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - Excel Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Excel Spawning Windows Script Host - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Excessive Service Stop Attempt - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Excessive Service Stop Attempt - Rule,https://research.splunk.com/endpoint/8f3a614f-6b98-4f7d-82dd-d0df38452a8b +ESCU - Excessive Usage Of Net App - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Excessive Usage Of Net App - Rule,https://research.splunk.com/endpoint/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Execution of File With Spaces Before Extension - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Execution of File with Multiple Extensions - Rule,https://research.splunk.com/endpoint/b06a555e-dce0-417d-a2eb-28a5d8d66ef7 +ESCU - Extended Period Without Successful Netbackup Backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Extraction of Registry Hives - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Sensitive Registry Hive Dump Via CommandLine - Rule,https://research.splunk.com/endpoint/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - First time seen command line argument - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Detect accounts with high risk roles by project - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Detect high risk permissions by resource and account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Kubernetes cluster scan detection - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Kubernetes Scanning by Unauthenticated IP Address - Rule,https://research.splunk.com/cloud/f9cadf4e-df22-4f4e-a08f-9d3344c2165d +ESCU - Identify New User Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure active service accounts by pod namespace - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure pod scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Linux Auditd Find Private Keys - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Linux Auditd Private Keys and Certificate Enumeration - Rule,https://research.splunk.com/endpoint/892eb674-3344-4143-8e52-4775b1daf3f1 +ESCU - Local Account Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Discovery Via Net - Rule,https://research.splunk.com/endpoint/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - MSHTML Module Load in Office Product - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loaded MSHTML Module - Rule,https://research.splunk.com/endpoint/4cc015c9-687c-40d2-adcc-46350f66e10c +ESCU - Monitor DNS For Brand Abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Users Failing To Authenticate From Ip - Rule,https://research.splunk.com/application/de365ffa-42f5-46b5-b43f-fa72290b8218 +ESCU - Net Localgroup Discovery - Rule,Detection,5.2.0,Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 / Windows Group Discovery Via Net,ESCU - Windows Group Discovery Via Net - Rule,https://research.splunk.com/endpoint/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Network Connection Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Network Connection Discovery Via Net - Rule,https://research.splunk.com/endpoint/86a5b949-679b-4197-8d4c-9c180a818c45 +ESCU - O365 Suspicious Admin Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Mailbox Email Forwarding Enabled - Rule,https://research.splunk.com/cloud/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - O365 Suspicious Rights Delegation - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Elevated Mailbox Permission Assigned - Rule,https://research.splunk.com/cloud/2246c142-a678-45f8-8546-aaed7e0efd30 +ESCU - O365 Suspicious User Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Mailbox Email Forwarding Enabled - Rule,https://research.splunk.com/cloud/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - Office Application Drop Executable - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Dropped Uncommon File - Rule,https://research.splunk.com/endpoint/7ac0fced-9eae-4381-a748-90dcd1aa9393 +ESCU - Office Application Spawn Regsvr32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Application Spawn rundll32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Document Creating Schedule Task - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loading Taskschd DLL - Rule,https://research.splunk.com/endpoint/d7297cfa-1f04-4714-bfbe-3679e0666959 +ESCU - Office Document Executing Macro Code - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loading VBE7 DLL - Rule,https://research.splunk.com/endpoint/7cfec906-2697-43f7-898b-83634a051d9a +ESCU - Office Document Spawned Child Process To Download - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Child Process For Download - Rule,https://research.splunk.com/endpoint/f02b64b8-cbea-4f75-bf77-7a05111566b1 +ESCU - Office Product Spawn CMD Process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning BITSAdmin - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning CertUtil - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning MSHTA - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning Rundll32 with no DLL - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Rundll32 With No DLL - Rule,https://research.splunk.com/endpoint/f28e787e-69ca-480e-9f98-ab970e6d4bcc +ESCU - Office Product Spawning Windows Script Host - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning Wmic - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Writing cab or inf - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Dropped Cab or Inf File - Rule,https://research.splunk.com/endpoint/dbdd251e-dd45-4ec9-a555-f5e151391746 +ESCU - Office Spawning Control - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Control - Rule,https://research.splunk.com/endpoint/081c485d-ac8d-4bee-ad4c-525772fead4d +ESCU - Okta Account Locked Out - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Accounts Locked Out - Rule,https://research.splunk.com/application/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Okta Account Lockout Events - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Accounts Locked Out - Rule,https://research.splunk.com/application/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Okta Failed SSO Attempts - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Unauthorized Access to Application - Rule,https://research.splunk.com/application/5f661629-9750-4cb9-897c-1f05d6db8727 +ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta ThreatInsight Threat Detected - Rule,https://research.splunk.com/application/140504ae-5fe2-4d65-b2bc-a211813fbca6 +ESCU - Okta Two or More Rejected Okta Pushes - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Failed MFA Requests For User - Rule,https://research.splunk.com/application/826dbaae-a1e6-4c8c-b384-d16898956e73 +ESCU - Open Redirect in Splunk Web - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Osquery pack - ColdRoot detection - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Password Policy Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Password Policy Discovery with Net - Rule,https://research.splunk.com/endpoint/e52f7865-be78-46bf-b7ed-150fbe447613 +ESCU - Processes created by netsh - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Processes launching netsh - Rule,https://research.splunk.com/endpoint/b89919ed-fe5f-492c-b139-95dbb162040e +ESCU - Prohibited Software On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Attacker Tools On Endpoint - Rule,https://research.splunk.com/endpoint/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - Reg exe used to hide files directories via registry keys - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote Registry Key modifications - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote System Discovery with Net - Rule,Detection,5.2.0,This analytic was focusing on 2 separate and unrelated type of threats or actions. PLease use the replacement content,ESCU - Windows Sensitive Group Discovery With Net - Rule,https://research.splunk.com/endpoint/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - Scheduled tasks used in BadRabbit ransomware - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Scheduled Task Deleted Or Created via CMD - Rule,https://research.splunk.com/endpoint/d5af132c-7c17-439c-9d31-13d55340f36c +ESCU - Spectre and Meltdown Vulnerable Systems - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Splunk Enterprise Information Disclosure - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Changes to File Associations - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Email - UBA Anomaly - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious File Write - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Powershell Command-Line Arguments - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Malicious PowerShell Process - Encoded Command - Rule,https://research.splunk.com/endpoint/c4db14d9-7909-48b4-a054-aa14d89dbb19 +ESCU - Suspicious Rundll32 Rename - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious writes to System Volume Information - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Uncommon Processes On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Attacker Tools On Endpoint - Rule,https://research.splunk.com/endpoint/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - Unsigned Image Loaded by LSASS - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Unsuccessful Netbackup backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Account Harvesting - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Anomalous User Clickspeed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Password Sharing Across Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows Command Shell Fetch Env Variables - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows List ENV Variables Via SET Command From Uncommon Parent - Rule,https://research.splunk.com/endpoint/aec157f4-8783-4584-aca6-754c4dc7fba9 +ESCU - Windows DLL Search Order Hijacking Hunt - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule,https://research.splunk.com/endpoint/79c7d1fc-64c7-91be-a616-ccda752efe81 +ESCU - Windows Lateral Tool Transfer RemCom - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Windows Service Execution RemCom - Rule,https://research.splunk.com/endpoint/7e3d68db-ea4d-419b-adbd-e14a525ecf09 +ESCU - Windows MSIExec With Network Connections - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows HTTP Network Communication From MSIExec - Rule,https://research.splunk.com/endpoint/b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 +ESCU - Windows Modify Registry Reg Restore - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Registry Entries Restored Via Reg - Rule,https://research.splunk.com/endpoint/a17af481-e2ad-494c-9da6-afb4d243a019 +ESCU - Windows Network Share Interaction With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Network Share Interaction Via Net - Rule,https://research.splunk.com/endpoint/e51fbdb0-0be0-474f-92ea-d289f71a695e +ESCU - Windows Office Product Spawning MSDT - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned MSDT - Rule,https://research.splunk.com/endpoint/a3148fad-3734-4b7f-9a71-62f08d39fab1 +ESCU - Windows Query Registry Reg Save - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Registry Entries Exported Via Reg - Rule,https://research.splunk.com/endpoint/466379bc-0f47-476c-8202-16ef38112e0d +ESCU - Windows Service Stop Via Net and SC Application - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows Valid Account With Never Expires Password - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Set Account Password Policy To Unlimited Via Net - Rule,https://research.splunk.com/endpoint/11f93009-8083-43fd-82a7-821fcbdc8342 +ESCU - Windows connhost exe started forcefully - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows hosts file modification - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Winword Spawning Cmd - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Winword Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Winword Spawning Windows Script Host - Rule,Detection,5.2.0,"The following analytics was deprecated in favour of a more generic approach. Where instead of creating specific analytic for every potentially suspicious child of an office product. We group them by threat level. +This would ease management and false positives tuning.",ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - gcp detect oauth token abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +AWS Cryptomining,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Cloud Cryptomining,https://research.splunk.com/stories/cloud_cryptomining +AWS Suspicious Provisioning Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Provisioning Activities,https://research.splunk.com/stories/suspicious_cloud_provisioning_activities +Common Phishing Frameworks,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Container Implantation Monitoring and Investigation,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Kubernetes Security,https://research.splunk.com/stories/kubernetes_security +Host Redirection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Kubernetes Sensitive Role Activity,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Kubernetes Security,https://research.splunk.com/stories/kubernetes_security +Lateral Movement,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Compromised User Account,https://research.splunk.com/stories/compromised_user_account +Monitor Backup Solution,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Monitor for Unauthorized Software,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Office 365 Detections,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Office 365 Account Takeover,https://research.splunk.com/stories/office_365_account_takeover +Spectre And Meltdown Vulnerabilities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Suspicious AWS EC2 Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Instance Activities,https://research.splunk.com/stories/suspicious_cloud_instance_activities +Unusual AWS EC2 Modifications,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Instance Activities,https://research.splunk.com/stories/suspicious_cloud_instance_activities +Web Fraud Detection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available diff --git a/lookups/deprecation_info.yml b/lookups/deprecation_info.yml new file mode 100644 index 0000000000..dab74f8b34 --- /dev/null +++ b/lookups/deprecation_info.yml @@ -0,0 +1,9 @@ +name: deprecation_info +date: 2025-03-14 +version: 1 +id: d83dad4f-7bce-4979-bf07-a88c610da5f6 +author: Splunk Threat Research Team +lookup_type: csv +default_match: false +description: A lookup file for deprecation information +min_matches: 1 diff --git a/lookups/ransomware_extensions_lookup.csv b/lookups/ransomware_extensions_lookup.csv index 38cca70a09..c6cb398475 100644 --- a/lookups/ransomware_extensions_lookup.csv +++ b/lookups/ransomware_extensions_lookup.csv @@ -300,4 +300,5 @@ Extensions,Name *.GANGBANG,Gangbang *.reddot,RedDot *.MEDUSA,Medusa -*.rhysida,Rhysida \ No newline at end of file +*.rhysida,Rhysida +*.basta, BlackBasta \ No newline at end of file diff --git a/lookups/ransomware_notes_lookup.yml b/lookups/ransomware_notes_lookup.yml index e36d441ec7..21ec31a3bf 100644 --- a/lookups/ransomware_notes_lookup.yml +++ b/lookups/ransomware_notes_lookup.yml @@ -1,6 +1,6 @@ name: ransomware_notes_lookup -date: 2024-12-23 -version: 2 +date: 2025-03-03 +version: 3 id: 93d9fb06-035e-496c-91d5-7a79543ce1e1 author: Splunk Threat Research Team lookup_type: csv diff --git a/macros/o365_suspect_search_terms_regex.yml b/macros/o365_suspect_search_terms_regex.yml new file mode 100644 index 0000000000..e78548955f --- /dev/null +++ b/macros/o365_suspect_search_terms_regex.yml @@ -0,0 +1,3 @@ +definition: "\"(?i)password|credential|login|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing\"" +description: A regex used with match statements preloaded with generic suspicious terms or phrases. Is used to detect malicious actor or insider threat searches, replace/modify these terms to suit your organization. +name: o365_suspect_search_terms_regex diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/removed/baselines/add_prohibited_processes_to_enterprise_security.yml similarity index 98% rename from baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml rename to removed/baselines/add_prohibited_processes_to_enterprise_security.yml index 607a5f9829..571031fc48 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/removed/baselines/add_prohibited_processes_to_enterprise_security.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/removed/baselines/baseline_of_api_calls_per_user_arn.yml similarity index 98% rename from baselines/deprecated/baseline_of_api_calls_per_user_arn.yml rename to removed/baselines/baseline_of_api_calls_per_user_arn.yml index 461b657a67..2673563607 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/removed/baselines/baseline_of_api_calls_per_user_arn.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-09' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml rename to removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index ade1932593..f239369ff1 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml rename to removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index a6d890da08..66859b3998 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search diff --git a/baselines/monitor_successful_backups.yml b/removed/baselines/monitor_successful_backups.yml similarity index 94% rename from baselines/monitor_successful_backups.yml rename to removed/baselines/monitor_successful_backups.yml index fe0c140a5a..ab88e7b269 100644 --- a/baselines/monitor_successful_backups.yml +++ b/removed/baselines/monitor_successful_backups.yml @@ -1,10 +1,10 @@ name: Monitor Successful Backups id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e -version: 1 -date: '2017-09-12' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/monitor_unsuccessful_backups.yml b/removed/baselines/monitor_unsuccessful_backups.yml similarity index 94% rename from baselines/monitor_unsuccessful_backups.yml rename to removed/baselines/monitor_unsuccessful_backups.yml index 83195cbae0..19c0d4ca73 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/removed/baselines/monitor_unsuccessful_backups.yml @@ -1,10 +1,10 @@ name: Monitor Unsuccessful Backups id: b2178fed-592f-492b-b851-74161678aa56 -version: 1 -date: '2017-09-12' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml rename to removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 71a860c70b..8725c77478 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/removed/baselines/previously_seen_aws_provisioning_activity_sources.yml similarity index 98% rename from baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml rename to removed/baselines/previously_seen_aws_provisioning_activity_sources.yml index b0c5e90290..96f8dccd31 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/removed/baselines/previously_seen_aws_provisioning_activity_sources.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. diff --git a/baselines/previously_seen_aws_regions.yml b/removed/baselines/previously_seen_aws_regions.yml similarity index 95% rename from baselines/previously_seen_aws_regions.yml rename to removed/baselines/previously_seen_aws_regions.yml index da7bd98582..c64933b437 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/removed/baselines/previously_seen_aws_regions.yml @@ -1,10 +1,10 @@ name: Previously Seen AWS Regions id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63 -version: 1 -date: '2018-01-08' +version: 2 +date: '2025-02-27' author: Bhavin Patel, Splunk type: Baseline -status: production +status: removed description: This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/removed/baselines/previously_seen_ec2_amis.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_amis.yml rename to removed/baselines/previously_seen_ec2_amis.yml index 1550cdf588..bc7c7ec00e 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/removed/baselines/previously_seen_ec2_amis.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen AMIs used to launch EC2 instances search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/removed/baselines/previously_seen_ec2_instance_types.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_instance_types.yml rename to removed/baselines/previously_seen_ec2_instance_types.yml index cfff4e6d58..4c1f2fa439 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/removed/baselines/previously_seen_ec2_instance_types.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen EC2 instance types search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/removed/baselines/previously_seen_ec2_launches_by_user.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_launches_by_user.yml rename to removed/baselines/previously_seen_ec2_launches_by_user.yml index d1aa8e8045..d90c9b44cc 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/removed/baselines/previously_seen_ec2_launches_by_user.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/removed/baselines/previously_seen_ec2_modifications_by_user.yml similarity index 95% rename from baselines/previously_seen_ec2_modifications_by_user.yml rename to removed/baselines/previously_seen_ec2_modifications_by_user.yml index fdf51c1460..09a26dca86 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/removed/baselines/previously_seen_ec2_modifications_by_user.yml @@ -1,10 +1,10 @@ name: Previously Seen EC2 Modifications By User id: 4d69091b-d975-4267-85df-888bd41034eb -version: 1 -date: '2018-04-05' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/removed/baselines/previously_seen_users_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/previously_seen_users_in_cloudtrail.yml rename to removed/baselines/previously_seen_users_in_cloudtrail.yml index f8e40480d7..2e3a762c8d 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/removed/baselines/previously_seen_users_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-30' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 diff --git a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml b/removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml similarity index 96% rename from baselines/systems_ready_for_spectre_meltdown_windows_patch.yml rename to removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml index 7b26e9e44d..54085fb1b2 100644 --- a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -1,10 +1,10 @@ name: Systems Ready for Spectre-Meltdown Windows Patch id: fc0edc95-ff2b-48b0-9f6f-63da3789fd61 -version: 1 -date: '2018-01-08' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/removed/baselines/update_previously_seen_users_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml rename to removed/baselines/update_previously_seen_users_in_cloudtrail.yml index 063ad93dcc..b12c1c002f 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/removed/baselines/update_previously_seen_users_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML new file mode 100644 index 0000000000..73220d59fb --- /dev/null +++ b/removed/deprecation_mapping.YML @@ -0,0 +1,1008 @@ +detections: + - content: Open Redirect in Splunk Web + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Splunk Enterprise Information Disclosure + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: ASL AWS Excessive Security Scanning + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS Cloud Provisioning From Previously Unseen Region + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Region + - content: First time seen command line argument + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows connhost exe started forcefully + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Mimikatz Using Loaded Images + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Web Fraud - Anomalous User Clickspeed + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: EC2 Instance Started With Previously Unseen Instance Type + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Instance Type + - content: EC2 Instance Started With Previously Unseen AMI + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Image + - content: Domain Group Discovery With Net + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Group Discovery Via Net + - content: Kubernetes AWS detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Winword Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: "The following analytics was deprecated in favour of a more generic approach. + Where instead of creating specific analytic for every potentially suspicious child + of an office product. We group them by threat level.\nThis would ease management + and false positives tuning." + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Winword Spawning PowerShell + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Attempted Credential Dump From Registry via Reg exe + removed_in_version: 5.2.0 + reason: This analytic had some overlap with another one, hence the deprecation. + It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry + Hive Dump Via CommandLine + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - content: Detect processes used for System Network Configuration Discovery + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Potential System Network Configuration Discovery Activity + - content: Execution of File With Spaces Before Extension + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Execution of File with Multiple Extensions + - content: EC2 Instance Started In Previously Unseen Region + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created In Previously Unused Region + - content: Office Document Spawned Child Process To Download + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Child Process For Download + - content: Detect new API calls from user roles + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - content: Cmdline Tool Not Executed In CMD Shell + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Cmdline Tool Execution From Non-Shell Process + - content: Linux Auditd Find Private Keys + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Linux Auditd Private Keys and Certificate Enumeration + - content: Detect AWS API Activities From Unapproved Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Monitor DNS For Brand Abuse + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect sensitive object access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure scan fingerprint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: ASL AWS Password Policy Changes + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: O365 Suspicious Admin Email Forwarding + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - content: AWS Cloud Provisioning From Previously Unseen City + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen City + - content: Kubernetes AWS detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Osquery pack - ColdRoot detection + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Modify Registry Reg Restore + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Restored Via Reg + - content: Kubernetes GCP detect most active service accounts by pod + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Scheduled tasks used in BadRabbit ransomware + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Scheduled Task Deleted Or Created via CMD + - content: Suspicious Rundll32 Rename + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote System Discovery with Net + removed_in_version: 5.2.0 + reason: "This analytic was focusing on 2 separate and unrelated type of threats + or actions. PLease use the replacement content" + replacement_content: + - Windows Sensitive Group Discovery With Net + - content: DNS Query Requests Resolved by Unauthorized DNS Servers + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Changes to File Associations + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GCP Detect high risk permissions by resource and account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Writing cab or inf + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Cab or Inf File + - content: Identify New User Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawn CMD Process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Windows DLL Search Order Hijacking Hunt + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Windows DLL Search Order Hijacking Hunt with Sysmon + - content: ASL AWS CreateAccessKey + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - ASL AWS Create Access Key + - content: Okta ThreatInsight Login Failure with High Unknown users + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Spike in Security Group Activity + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Security Group API Calls + - content: Office Product Spawning BITSAdmin + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Create local admin accounts using net exe + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Create Local Administrator Account Via Net + - content: Abnormally High AWS Instances Terminated by User - MLTK + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Office Product Spawning MSDT + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned MSDT + - content: Detect Spike in AWS API Activity + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Prohibited Software On Endpoint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - content: AWS Cloud Provisioning From Previously Unseen Country + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Country + - content: Detect Critical Alerts from Security Tools + removed_in_version: 5.2.0 + reason: As discussed internally, this analytic was too generic for an analyst to + do anything with it. It was deprecated in favor of the more specific approach + provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender + Incident Alerts. Going forward analytics from leveraging alerts from vendors will + have their specific analytics. + replacement_content: + - Microsoft Defender ATP Alerts + - content: Detect Critical Alerts from Security Tools + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Microsoft Defender Incident Alerts + - content: Excel Spawning PowerShell + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Office Application Spawn rundll32 process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Excessive Usage Of Net App + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Usage Of Net App + - content: Elevated Group Discovery With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Group Discovery With Net + - content: Local Account Discovery with Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Discovery Via Net + - content: Windows Command Shell Fetch Env Variables + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows List ENV Variables Via SET Command From Uncommon Parent + - content: Suspicious Email - UBA Anomaly + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect web traffic to dynamic domain providers + removed_in_version: 5.2.0 + reason: Updated to use a different log source + replacement_content: + - Detect hosts connecting to dynamic domain providers + - content: Okta Failed SSO Attempts + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Unauthorized Access to Application + - content: Kubernetes AWS detect RBAC authorization by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote Registry Key modifications + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: O365 Suspicious User Email Forwarding + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - content: Office Product Spawning MSHTA + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Kubernetes AWS detect most active service accounts by pod + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Correlation by Repository and Risk + removed_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - content: Kubernetes Azure detect RBAC authorization by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Clients Connecting to Multiple DNS Servers + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Excessive Service Stop Attempt + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Service Stop Attempt + - content: Multiple Okta Users With Invalid Credentials From The Same IP + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Users Failing To Authenticate From Ip + - content: Suspicious writes to System Volume Information + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect new user AWS Console Login + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Detect AWS Console Login by New User + - content: Domain Account Discovery With Net App + removed_in_version: 5.2.0 + reason: "This analytic was a TTP that looked only for commands that tries to query + info about the users via net user /do. This had a couple of issues, such as triggering + on creation of users via the /add flag etc..\nIt was deprecated in favor of a + more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122" + replacement_content: + - Windows User Discovery Via Net + - content: Detection of DNS Tunnels + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect DNS requests to Phishing Sites leveraging EvilGinx2 + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Document Creating Schedule Task + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading Taskschd DLL + - content: Okta Account Locked Out + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - content: Unsuccessful Netbackup backups + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Mimikatz Via PowerShell And EventCode 4703 + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Detect Mimikatz With PowerShell Script Block Logging + - content: Winword Spawning Cmd + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: GCP Kubernetes cluster scan detection + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Scanning by Unauthenticated IP Address + - content: Kubernetes GCP detect suspicious kubectl calls + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: gcp detect oauth token abuse + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Correlation by User and Risk + removed_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - content: Processes created by netsh + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Processes launching netsh + - content: Office Product Spawning Wmic + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Extraction of Registry Hives + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - content: Attempt To Stop Security Service + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Attempt To Stop Security Service + - content: Windows MSIExec With Network Connections + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows HTTP Network Communication From MSIExec + - content: Windows Query Registry Reg Save + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Exported Via Reg + - content: Cloud Network Access Control List Deleted + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Network Access Control List Deleted + - content: O365 Suspicious Rights Delegation + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Elevated Mailbox Permission Assigned + - content: Abnormally High AWS Instances Launched by User - MLTK + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Reg exe used to hide files directories via registry keys + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Long DNS TXT Record Response + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Password Policy Discovery with Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Password Policy Discovery with Net + - content: AWS Cloud Provisioning From Previously Unseen IP Address + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen IP Address + - content: Network Connection Discovery With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Connection Discovery Via Net + - content: Kubernetes Azure detect suspicious kubectl calls + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Webshell Exploit Behavior + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Suspicious Child Process Spawned From WebServer + - content: DNS record changed + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Unsigned Image Loaded by LSASS + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect USB device insertion + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Network Share Interaction With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Share Interaction Via Net + - content: Account Discovery With Net App + removed_in_version: 5.2.0 + reason: This analytic was a TTP that focused on unrelated things and called account + discovery. Since there were other detection that overlapped with it. I choose + to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 + / Windows Excessive Usage Of Net App. + replacement_content: + - Windows Excessive Usage Of Net App + - content: Change Default File Association + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows New Default File Association Value Set + - content: Windows Lateral Tool Transfer RemCom + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Windows Service Execution RemCom + - content: Office Document Executing Macro Code + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading VBE7 DLL + - content: Okta Account Lockout Events + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - content: Abnormally High AWS Instances Launched by User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Launched + - content: EC2 Instance Modified With Previously Unseen User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - content: Windows Valid Account With Never Expires Password + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Set Account Password Policy To Unlimited Via Net + - content: Windows hosts file modification + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: MSHTML Module Load in Office Product + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loaded MSHTML Module + - content: Abnormally High AWS Instances Terminated by User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Destroyed + - content: Web Fraud - Account Harvesting + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Spawning Control + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Control + - content: Detect Activity Related to Pass the Hash Attacks + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Deleting Of Net Users + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Deletion Via Net + - content: Suspicious File Write + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS EKS Kubernetes cluster sensitive object access + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Abuse of Secret by Unusual Location + - content: Spectre and Meltdown Vulnerable Systems + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: EC2 Instance Started With Previously Unseen User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created By Previously Unseen User + - content: Office Product Spawning CertUtil + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Kubernetes GCP detect RBAC authorizations by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Application Drop Executable + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Uncommon File + - content: Kubernetes Azure active service accounts by pod namespace + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure pod scan fingerprint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Spike in Network ACL Activity + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Infrastructure API Calls + - content: Suspicious Powershell Command-Line Arguments + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Malicious PowerShell Process - Encoded Command + - content: Office Application Spawn Regsvr32 process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Detect API activity from users without MFA + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Successful Single-Factor Authentication + - content: Kubernetes Azure detect sensitive object access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Web Fraud - Password Sharing Across Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Disabling Net User Account + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Disabled Via Net + - content: GCP Detect accounts with high risk roles by project + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Extended Period Without Successful Netbackup Backups + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawning Rundll32 with no DLL + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Rundll32 With No DLL + - content: Okta ThreatInsight Suspected PasswordSpray Attack + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta ThreatInsight Threat Detected + - content: Net Localgroup Discovery + removed_in_version: 5.2.0 + reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + / Windows Group Discovery Via Net + replacement_content: + - Windows Group Discovery Via Net + - content: Uncommon Processes On Endpoint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - content: Dump LSASS via procdump Rename + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Dump LSASS via procdump + - content: Okta Two or More Rejected Okta Pushes + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Failed MFA Requests For User + - content: Windows Service Stop Via Net and SC Application + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Excel Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Actions Disable Security Workflow + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Github Commit Changes In Master + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Github Commit In Develop + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Dependabot Alert + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Pull Request from Unknown User + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Known Services Killed by Ransomware + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote Desktop Network Bruteforce + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Driver Loaded Path + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Event Log Service Behavior + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Process File Path + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS Cross Account Activity From Previously Unseen Account + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect attach to role policy + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect permanent key creation + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect role creation + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect sts assume role abuse + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect sts get session token abuse + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS SAML Access by Provider User and Principal + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity +baselines: + - content: Add Prohibited Processes to Enterprise Security + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of API Calls per User ARN + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of Excessive AWS Instances Launched by User - MLTK + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of Excessive AWS Instances Terminated by User - MLTK + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously seen API call per user roles in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Provisioning Activity Sources + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 AMIs + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Instance Types + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Launches By User + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously seen users in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Update previously seen users in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Monitor Successful Backups + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Monitor Unsuccessful Backups + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Regions + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Modifications By User + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Systems Ready for Spectre-Meltdown Windows Patch + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Cross Account Activity - Initial + removed_in_version: 5.4.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Cross Account Activity - Update + removed_in_version: 5.4.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' +investigations: + - content: All backup logs for host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Amazon EKS Kubernetes activity by src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate Security Hub alerts by dest + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate User Activities By AccessKeyId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate User Activities By ARN + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Network ACL Details from ID + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Network Interface details via resourceId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS S3 Bucket details via bucketName + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: GCP Kubernetes activity by src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From City + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From Country + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From IP Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From Region + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Backup Logs For Endpoint + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Certificate logs for a domain + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get DNS Server History for a host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get DNS traffic ratio + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get EC2 Instance Details by instanceId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get EC2 Launch Details + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Email Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Emails From Specific Sender + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get First Occurrence and Last Occurrence of a MAC Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get History Of Email Sources + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Logon Rights Modifications For Endpoint + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Logon Rights Modifications For User + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Notable History + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Outbound Emails to Hidden Cobra Threat Actors + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Parent Process Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process File Activity + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Information For Port Activity + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Responsible For The DNS Traffic + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Sysmon WMI Activity for Host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Web Session Information via session id + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate AWS activities via region name + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate AWS User Activities by user field + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Failed Logins for Multiple Destinations + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Network Traffic From src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Okta Activity by app + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Okta Activity by IP Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Pass the Hash Attempts + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Pass the Ticket Attempts + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Previous Unseen User + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Successful Remote Desktop Authentications + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Suspicious Strings in HTTP Header + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate User Activities In Okta + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Web POSTs From src + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' +stories: + - content: AWS Cryptomining + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Cloud Cryptomining + - content: AWS Suspicious Provisioning Activities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Provisioning Activities + - content: Common Phishing Frameworks + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Container Implantation Monitoring and Investigation + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - content: Host Redirection + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Sensitive Role Activity + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - content: Lateral Movement + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Compromised User Account + - content: Monitor Backup Solution + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Monitor for Unauthorized Software + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Office 365 Detections + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Office 365 Account Takeover + - content: Spectre And Meltdown Vulnerabilities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious AWS EC2 Activities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - content: Unusual AWS EC2 Modifications + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - content: Web Fraud Detection + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Nexus APT Threat Activity + removed_in_version: 5.4.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - China-Nexus Threat Activity \ No newline at end of file diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/removed/detections/abnormally_high_aws_instances_launched_by_user.yml similarity index 99% rename from detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml rename to removed/detections/abnormally_high_aws_instances_launched_by_user.yml index e46dec6369..595bc299da 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/removed/detections/abnormally_high_aws_instances_launched_by_user.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml similarity index 98% rename from detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml rename to removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml index 9acc4411b2..d70e23808e 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -3,7 +3,7 @@ id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 version: 5 date: '2024-11-14' author: Jason Brewer, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/removed/detections/abnormally_high_aws_instances_terminated_by_user.yml similarity index 99% rename from detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml rename to removed/detections/abnormally_high_aws_instances_terminated_by_user.yml index ae3c15024b..7ce46aff25 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/removed/detections/abnormally_high_aws_instances_terminated_by_user.yml @@ -3,7 +3,7 @@ id: 8d301246-fccf-45e2-a8e7-3655fd14379c version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml similarity index 98% rename from detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml rename to removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 04f88a704a..4581feda8f 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -3,7 +3,7 @@ id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e version: 5 date: '2024-11-14' author: Jason Brewer, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and diff --git a/detections/deprecated/account_discovery_with_net_app.yml b/removed/detections/account_discovery_with_net_app.yml similarity index 99% rename from detections/deprecated/account_discovery_with_net_app.yml rename to removed/detections/account_discovery_with_net_app.yml index 074b4fba7a..ddb1846f2e 100644 --- a/detections/deprecated/account_discovery_with_net_app.yml +++ b/removed/detections/account_discovery_with_net_app.yml @@ -3,7 +3,7 @@ id: 339805ce-ac30-11eb-b87d-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of the more generic "45e52536-ae42-11eb-b5c6-acde48001122". The following analytic detects potential diff --git a/detections/deprecated/asl_aws_createaccesskey.yml b/removed/detections/asl_aws_createaccesskey.yml similarity index 99% rename from detections/deprecated/asl_aws_createaccesskey.yml rename to removed/detections/asl_aws_createaccesskey.yml index e7588388f6..a4fe172ca3 100644 --- a/detections/deprecated/asl_aws_createaccesskey.yml +++ b/removed/detections/asl_aws_createaccesskey.yml @@ -3,7 +3,7 @@ id: ccb3e4af-23d6-407f-9842-a26212816c9e version: 3 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This detection rule monitors for the creation of AWS Identity and Access Management (IAM) access keys. An IAM access key consists of an access key ID and diff --git a/detections/deprecated/asl_aws_excessive_security_scanning.yml b/removed/detections/asl_aws_excessive_security_scanning.yml similarity index 99% rename from detections/deprecated/asl_aws_excessive_security_scanning.yml rename to removed/detections/asl_aws_excessive_security_scanning.yml index 0ee3a463e3..6f8c8c2cf2 100644 --- a/detections/deprecated/asl_aws_excessive_security_scanning.yml +++ b/removed/detections/asl_aws_excessive_security_scanning.yml @@ -3,7 +3,7 @@ id: ff2bfdbc-65b7-4434-8f08-d55761d1d446 version: 4 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this diff --git a/detections/deprecated/asl_aws_password_policy_changes.yml b/removed/detections/asl_aws_password_policy_changes.yml similarity index 99% rename from detections/deprecated/asl_aws_password_policy_changes.yml rename to removed/detections/asl_aws_password_policy_changes.yml index d791f17208..faa1c0ef93 100644 --- a/detections/deprecated/asl_aws_password_policy_changes.yml +++ b/removed/detections/asl_aws_password_policy_changes.yml @@ -3,7 +3,7 @@ id: 5ade5937-11a2-4363-ba6b-39a3ee8d5b1a version: 3 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events from Amazon Security Lake where a user is making successful API calls to view/update/delete the existing password diff --git a/detections/deprecated/attempt_to_stop_security_service.yml b/removed/detections/attempt_to_stop_security_service.yml similarity index 99% rename from detections/deprecated/attempt_to_stop_security_service.yml rename to removed/detections/attempt_to_stop_security_service.yml index 1964d9b110..0fca86d98e 100644 --- a/detections/deprecated/attempt_to_stop_security_service.yml +++ b/removed/detections/attempt_to_stop_security_service.yml @@ -3,7 +3,7 @@ id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 version: 11 date: '2025-02-10' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious diff --git a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml b/removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 99% rename from detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml rename to removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 65c188a991..5dfdbf1e49 100644 --- a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -3,7 +3,7 @@ id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 version: 14 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". The following analytic detects the execution of reg.exe with parameters that export diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml index 91a576d2f0..93e513cc2c 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -3,7 +3,7 @@ id: 344a1778-0b25-490c-adb1-de8beddf59cd version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml index 986a31d1f0..5c7257858e 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -3,7 +3,7 @@ id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 5568175da0..13a7f90294 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -3,7 +3,7 @@ id: 42e15012-ac14-4801-94f4-f1acbe64880b version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml index 5efa68a449..039f1cd76c 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: 7971d3df-da82-4648-a6e5-b5637bea5253 version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning diff --git a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml b/removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml rename to removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml index 866bca7809..c337fae5d0 100644 --- a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml +++ b/removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/change_default_file_association.yml b/removed/detections/change_default_file_association.yml similarity index 99% rename from detections/deprecated/change_default_file_association.yml rename to removed/detections/change_default_file_association.yml index e5e583848a..3025b5adeb 100644 --- a/detections/deprecated/change_default_file_association.yml +++ b/removed/detections/change_default_file_association.yml @@ -3,7 +3,7 @@ id: 462d17d8-1f71-11ec-ad07-acde48001122 version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects suspicious registry modifications that change the default file association to execute diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/removed/detections/clients_connecting_to_multiple_dns_servers.yml similarity index 99% rename from detections/deprecated/clients_connecting_to_multiple_dns_servers.yml rename to removed/detections/clients_connecting_to_multiple_dns_servers.yml index eb01c32ea2..d5371b4c99 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/removed/detections/clients_connecting_to_multiple_dns_servers.yml @@ -3,7 +3,7 @@ id: 74ec6f18-604b-4202-a567-86b2066be3ce version: 6 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search. diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/removed/detections/cloud_network_access_control_list_deleted.yml similarity index 98% rename from detections/deprecated/cloud_network_access_control_list_deleted.yml rename to removed/detections/cloud_network_access_control_list_deleted.yml index 8a9036b76a..bb84da3f50 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/removed/detections/cloud_network_access_control_list_deleted.yml @@ -3,7 +3,7 @@ id: 021abc51-1862-41dd-ad43-43c739c0a983 version: 4 date: '2024-11-14' author: Peter Gael, Splunk -status: deprecated +status: removed type: Anomaly description: Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker diff --git a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml b/removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml similarity index 99% rename from detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml rename to removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml index 74087020ed..772d5444d8 100644 --- a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml @@ -3,7 +3,7 @@ id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, diff --git a/detections/deprecated/correlation_by_repository_and_risk.yml b/removed/detections/correlation_by_repository_and_risk.yml similarity index 99% rename from detections/deprecated/correlation_by_repository_and_risk.yml rename to removed/detections/correlation_by_repository_and_risk.yml index 681f046bf4..a3e5fea3e7 100644 --- a/detections/deprecated/correlation_by_repository_and_risk.yml +++ b/removed/detections/correlation_by_repository_and_risk.yml @@ -3,7 +3,7 @@ id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Correlation description: |- This search has been deprecated and updated with Risk Rule for Dev Sec Ops by Repository detection. The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts. diff --git a/detections/deprecated/correlation_by_user_and_risk.yml b/removed/detections/correlation_by_user_and_risk.yml similarity index 98% rename from detections/deprecated/correlation_by_user_and_risk.yml rename to removed/detections/correlation_by_user_and_risk.yml index d121453be9..95a4e50e10 100644 --- a/detections/deprecated/correlation_by_user_and_risk.yml +++ b/removed/detections/correlation_by_user_and_risk.yml @@ -3,7 +3,7 @@ id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Correlation description: |- The following analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event. diff --git a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml b/removed/detections/create_local_admin_accounts_using_net_exe.yml similarity index 99% rename from detections/deprecated/create_local_admin_accounts_using_net_exe.yml rename to removed/detections/create_local_admin_accounts_using_net_exe.yml index 05bd612ba3..5534cdc2d0 100644 --- a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml +++ b/removed/detections/create_local_admin_accounts_using_net_exe.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-151bb162040e version: 17 date: '2025-02-10' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the creation of local administrator accounts using the net.exe command. It leverages diff --git a/detections/deprecated/deleting_of_net_users.yml b/removed/detections/deleting_of_net_users.yml similarity index 99% rename from detections/deprecated/deleting_of_net_users.yml rename to removed/detections/deleting_of_net_users.yml index 379264584f..48c661fd73 100644 --- a/detections/deprecated/deleting_of_net_users.yml +++ b/removed/detections/deleting_of_net_users.yml @@ -3,7 +3,7 @@ id: 1c8c6f66-acce-11eb-aafb-acde48001122 version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of net.exe or net1.exe command-line diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 99% rename from detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml rename to removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml index 9b6c9aec2c..c57b95da42 100644 --- a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml @@ -3,7 +3,7 @@ id: f5939373-8054-40ad-8c64-cec478a22a4b version: 10 date: '2025-02-10' author: Bhavin Patel, Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/removed/detections/detect_api_activity_from_users_without_mfa.yml similarity index 99% rename from detections/deprecated/detect_api_activity_from_users_without_mfa.yml rename to removed/detections/detect_api_activity_from_users_without_mfa.yml index e0ad2efcfc..f7da7f035d 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/removed/detections/detect_api_activity_from_users_without_mfa.yml @@ -3,7 +3,7 @@ id: 4d46e8bd-4072-48e4-92db-0325889ef894 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml similarity index 99% rename from detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml rename to removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml index 23e833aac1..98b40ed434 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d4bd55 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns diff --git a/detections/deprecated/detect_critical_alerts_from_security_tools.yml b/removed/detections/detect_critical_alerts_from_security_tools.yml similarity index 99% rename from detections/deprecated/detect_critical_alerts_from_security_tools.yml rename to removed/detections/detect_critical_alerts_from_security_tools.yml index 79ba56809d..a1bdeec87e 100644 --- a/detections/deprecated/detect_critical_alerts_from_security_tools.yml +++ b/removed/detections/detect_critical_alerts_from_security_tools.yml @@ -3,7 +3,7 @@ id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd version: 2 date: '2025-01-13' author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk -status: deprecated +status: removed type: TTP data_source: - Windows Defender Alerts diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml similarity index 99% rename from detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml rename to removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index 2d4975f3ec..05a6f77ef4 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites. diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/removed/detections/detect_long_dns_txt_record_response.yml similarity index 99% rename from detections/deprecated/detect_long_dns_txt_record_response.yml rename to removed/detections/detect_long_dns_txt_record_response.yml index 57a2fb80be..1329c3bf26 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/removed/detections/detect_long_dns_txt_record_response.yml @@ -3,7 +3,7 @@ id: 05437c07-62f5-452e-afdc-04dd44815bb9 version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/removed/detections/detect_mimikatz_using_loaded_images.yml similarity index 99% rename from detections/deprecated/detect_mimikatz_using_loaded_images.yml rename to removed/detections/detect_mimikatz_using_loaded_images.yml index 75e66c0061..6fbe7ff5e7 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/removed/detections/detect_mimikatz_using_loaded_images.yml @@ -3,7 +3,7 @@ id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml similarity index 99% rename from detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml rename to removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml index aa9cabe8d3..a97cc408bb 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -3,7 +3,7 @@ id: 98917be2-bfc8-475a-8618-a9bb06575188 version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/removed/detections/detect_new_api_calls_from_user_roles.yml similarity index 99% rename from detections/deprecated/detect_new_api_calls_from_user_roles.yml rename to removed/detections/detect_new_api_calls_from_user_roles.yml index 5ed0943c52..6875898fc1 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/removed/detections/detect_new_api_calls_from_user_roles.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f335b4f1 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/removed/detections/detect_new_user_aws_console_login.yml similarity index 99% rename from detections/deprecated/detect_new_user_aws_console_login.yml rename to removed/detections/detect_new_user_aws_console_login.yml index 1713d3b52d..75f7756e52 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/removed/detections/detect_new_user_aws_console_login.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362dffd75 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup diff --git a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml b/removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml similarity index 99% rename from detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml rename to removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml index d0851935d2..e46c595fe9 100644 --- a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 version: 8 date: '2025-01-24' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies the rapid execution of processes used diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/removed/detections/detect_spike_in_aws_api_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_aws_api_activity.yml rename to removed/detections/detect_spike_in_aws_api_activity.yml index 5a7efe7007..97feb48d8b 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/removed/detections/detect_spike_in_aws_api_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d32362d4bd55 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/removed/detections/detect_spike_in_network_acl_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_network_acl_activity.yml rename to removed/detections/detect_spike_in_network_acl_activity.yml index a7e693bf9e..fa43ca2e7d 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/removed/detections/detect_spike_in_network_acl_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a1f1-e32372d4bd53 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/removed/detections/detect_spike_in_security_group_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_security_group_activity.yml rename to removed/detections/detect_spike_in_security_group_activity.yml index de1cad3b6d..a6c75ede25 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/removed/detections/detect_spike_in_security_group_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-e32372d4bd53 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/removed/detections/detect_usb_device_insertion.yml similarity index 99% rename from detections/deprecated/detect_usb_device_insertion.yml rename to removed/detections/detect_usb_device_insertion.yml index 2d6dd088f5..98ea80b3e0 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/removed/detections/detect_usb_device_insertion.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f5 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 99% rename from detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml rename to removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml index deadd5d14b..7b61741b56 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml @@ -3,7 +3,7 @@ id: 134da869-e264-4a8f-8d7e-fcd01c18f301 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for web connections to dynamic DNS providers. data_source: [] diff --git a/detections/deprecated/detect_webshell_exploit_behavior.yml b/removed/detections/detect_webshell_exploit_behavior.yml similarity index 99% rename from detections/deprecated/detect_webshell_exploit_behavior.yml rename to removed/detections/detect_webshell_exploit_behavior.yml index a460946a1a..679f7cfd64 100644 --- a/detections/deprecated/detect_webshell_exploit_behavior.yml +++ b/removed/detections/detect_webshell_exploit_behavior.yml @@ -3,7 +3,7 @@ id: 22597426-6dbd-49bd-bcdc-4ec19857192f version: 8 date: '2025-02-10' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies the execution of suspicious processes typically associated with webshell activity diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/removed/detections/detection_of_dns_tunnels.yml similarity index 99% rename from detections/deprecated/detection_of_dns_tunnels.yml rename to removed/detections/detection_of_dns_tunnels.yml index e903bf4d9a..cabfa19b64 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/removed/detections/detection_of_dns_tunnels.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f4 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: "This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential diff --git a/detections/deprecated/disabling_net_user_account.yml b/removed/detections/disabling_net_user_account.yml similarity index 99% rename from detections/deprecated/disabling_net_user_account.yml rename to removed/detections/disabling_net_user_account.yml index 409e89854a..56936042e3 100644 --- a/detections/deprecated/disabling_net_user_account.yml +++ b/removed/detections/disabling_net_user_account.yml @@ -3,7 +3,7 @@ id: c0325326-acd6-11eb-98c2-acde48001122 version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of the `net.exe` utility to disable diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 98% rename from detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index b52f87457a..680f232852 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -3,7 +3,7 @@ id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and diff --git a/detections/deprecated/dns_record_changed.yml b/removed/detections/dns_record_changed.yml similarity index 99% rename from detections/deprecated/dns_record_changed.yml rename to removed/detections/dns_record_changed.yml index 1da12999ba..d620468bcf 100644 --- a/detections/deprecated/dns_record_changed.yml +++ b/removed/detections/dns_record_changed.yml @@ -3,7 +3,7 @@ id: 44d3a43e-dcd5-49f7-8356-5209bb369065 version: 6 date: '2024-11-14' author: Jose Hernandez, Splunk -status: deprecated +status: removed type: TTP description: The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the diff --git a/detections/deprecated/domain_account_discovery_with_net_app.yml b/removed/detections/domain_account_discovery_with_net_app.yml similarity index 99% rename from detections/deprecated/domain_account_discovery_with_net_app.yml rename to removed/detections/domain_account_discovery_with_net_app.yml index a1518a4c1f..98dfe89c93 100644 --- a/detections/deprecated/domain_account_discovery_with_net_app.yml +++ b/removed/detections/domain_account_discovery_with_net_app.yml @@ -3,7 +3,7 @@ id: 98f6a534-04c2-11ec-96b2-acde48001122 version: 6 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: This following analytic has been deprecated in favour of the generic version "5d0d4830-0133-11ec-bae3-acde48001122". The following analytic detects the diff --git a/detections/deprecated/domain_group_discovery_with_net.yml b/removed/detections/domain_group_discovery_with_net.yml similarity index 99% rename from detections/deprecated/domain_group_discovery_with_net.yml rename to removed/detections/domain_group_discovery_with_net.yml index 928dec10e8..cdb1b85e11 100644 --- a/detections/deprecated/domain_group_discovery_with_net.yml +++ b/removed/detections/domain_group_discovery_with_net.yml @@ -3,7 +3,7 @@ id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/removed/detections/dump_lsass_via_procdump_rename.yml similarity index 99% rename from detections/deprecated/dump_lsass_via_procdump_rename.yml rename to removed/detections/dump_lsass_via_procdump_rename.yml index db67928fa4..646606d2fa 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/removed/detections/dump_lsass_via_procdump_rename.yml @@ -3,7 +3,7 @@ id: 21276daa-663d-11eb-ae93-0242ac130002 version: 4 date: '2024-11-14' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: "Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/removed/detections/ec2_instance_modified_with_previously_unseen_user.yml similarity index 99% rename from detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml rename to removed/detections/ec2_instance_modified_with_previously_unseen_user.yml index c0dddee3ca..c41e9ef0f2 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/removed/detections/ec2_instance_modified_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 56f91724-cf3f-4666-84e1-e3712fb41e76 version: 6 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/removed/detections/ec2_instance_started_in_previously_unseen_region.yml similarity index 98% rename from detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml rename to removed/detections/ec2_instance_started_in_previously_unseen_region.yml index 0d7e62b234..0ddc56e39b 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/removed/detections/ec2_instance_started_in_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362d6fd75 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/removed/detections/ec2_instance_started_with_previously_unseen_ami.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_ami.yml index 80a929eefb..a801015f2d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_ami.yml @@ -3,7 +3,7 @@ id: 347ec301-601b-48b9-81aa-9ddf9c829dd3 version: 5 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml index e1a95404a0..1f549688bd 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -3,7 +3,7 @@ id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad version: 6 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/removed/detections/ec2_instance_started_with_previously_unseen_user.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_user.yml index d43786da55..e2b75f6b5d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f735b4f1 version: 6 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the diff --git a/detections/deprecated/elevated_group_discovery_with_net.yml b/removed/detections/elevated_group_discovery_with_net.yml similarity index 99% rename from detections/deprecated/elevated_group_discovery_with_net.yml rename to removed/detections/elevated_group_discovery_with_net.yml index a941649159..d2239f33b0 100644 --- a/detections/deprecated/elevated_group_discovery_with_net.yml +++ b/removed/detections/elevated_group_discovery_with_net.yml @@ -3,7 +3,7 @@ id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query diff --git a/detections/deprecated/excel_spawning_powershell.yml b/removed/detections/excel_spawning_powershell.yml similarity index 99% rename from detections/deprecated/excel_spawning_powershell.yml rename to removed/detections/excel_spawning_powershell.yml index 764de86234..10332d5d80 100644 --- a/detections/deprecated/excel_spawning_powershell.yml +++ b/removed/detections/excel_spawning_powershell.yml @@ -3,7 +3,7 @@ id: 42d40a22-9be3-11eb-8f08-acde48001122 version: 9 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/excel_spawning_windows_script_host.yml b/removed/detections/excel_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/excel_spawning_windows_script_host.yml rename to removed/detections/excel_spawning_windows_script_host.yml index 40deb89c49..404e72e788 100644 --- a/detections/deprecated/excel_spawning_windows_script_host.yml +++ b/removed/detections/excel_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 57fe880a-9be3-11eb-9bf3-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Excel spawns diff --git a/detections/deprecated/excessive_service_stop_attempt.yml b/removed/detections/excessive_service_stop_attempt.yml similarity index 99% rename from detections/deprecated/excessive_service_stop_attempt.yml rename to removed/detections/excessive_service_stop_attempt.yml index 3e27dc456b..c1d3ad9f3c 100644 --- a/detections/deprecated/excessive_service_stop_attempt.yml +++ b/removed/detections/excessive_service_stop_attempt.yml @@ -3,7 +3,7 @@ id: ae8d3f4a-acd7-11eb-8846-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic detects multiple attempts to stop or delete services diff --git a/detections/deprecated/excessive_usage_of_net_app.yml b/removed/detections/excessive_usage_of_net_app.yml similarity index 99% rename from detections/deprecated/excessive_usage_of_net_app.yml rename to removed/detections/excessive_usage_of_net_app.yml index 1b3556f57b..c993f62522 100644 --- a/detections/deprecated/excessive_usage_of_net_app.yml +++ b/removed/detections/excessive_usage_of_net_app.yml @@ -3,7 +3,7 @@ id: 45e52536-ae42-11eb-b5c6-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic detects excessive usage of `net.exe` or `net1.exe` diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/removed/detections/execution_of_file_with_spaces_before_extension.yml similarity index 99% rename from detections/deprecated/execution_of_file_with_spaces_before_extension.yml rename to removed/detections/execution_of_file_with_spaces_before_extension.yml index 6e453a7f03..ef42aea3b4 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/removed/detections/execution_of_file_with_spaces_before_extension.yml @@ -3,7 +3,7 @@ id: ab0353e6-a956-420b-b724-a8b4846d5d5a version: 6 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/removed/detections/extended_period_without_successful_netbackup_backups.yml similarity index 98% rename from detections/deprecated/extended_period_without_successful_netbackup_backups.yml rename to removed/detections/extended_period_without_successful_netbackup_backups.yml index c72e3977a2..fa3e78bc00 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/removed/detections/extended_period_without_successful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea214444440 version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. diff --git a/detections/deprecated/extraction_of_registry_hives.yml b/removed/detections/extraction_of_registry_hives.yml similarity index 99% rename from detections/deprecated/extraction_of_registry_hives.yml rename to removed/detections/extraction_of_registry_hives.yml index ceb5264fa6..ed19f50850 100644 --- a/detections/deprecated/extraction_of_registry_hives.yml +++ b/removed/detections/extraction_of_registry_hives.yml @@ -3,7 +3,7 @@ id: 8bbb7d58-b360-11eb-ba21-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/removed/detections/first_time_seen_command_line_argument.yml similarity index 99% rename from detections/deprecated/first_time_seen_command_line_argument.yml rename to removed/detections/first_time_seen_command_line_argument.yml index 5df827cada..b11889326f 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/removed/detections/first_time_seen_command_line_argument.yml @@ -3,7 +3,7 @@ id: a1b6e73f-98d5-470f-99ac-77aacd578473 version: 8 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. diff --git a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml similarity index 98% rename from detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml rename to removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 10a412fbc9..e1ff155ab4 100644 --- a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -3,7 +3,7 @@ id: 27af8c15-38b0-4408-b339-920170724adb version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges diff --git a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml similarity index 98% rename from detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml rename to removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 1291444493..4082bc1b56 100644 --- a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -3,7 +3,7 @@ id: 2e70ef35-2187-431f-aedc-4503dc9b06ba version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts diff --git a/detections/deprecated/gcp_detect_oauth_token_abuse.yml b/removed/detections/gcp_detect_oauth_token_abuse.yml similarity index 98% rename from detections/deprecated/gcp_detect_oauth_token_abuse.yml rename to removed/detections/gcp_detect_oauth_token_abuse.yml index 25144dd436..16b1471ac1 100644 --- a/detections/deprecated/gcp_detect_oauth_token_abuse.yml +++ b/removed/detections/gcp_detect_oauth_token_abuse.yml @@ -3,7 +3,7 @@ id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access diff --git a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml b/removed/detections/gcp_kubernetes_cluster_scan_detection.yml similarity index 99% rename from detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml rename to removed/detections/gcp_kubernetes_cluster_scan_detection.yml index f8fabad5ff..414be67679 100644 --- a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml +++ b/removed/detections/gcp_kubernetes_cluster_scan_detection.yml @@ -3,7 +3,7 @@ id: db5957ec-0144-4c56-b512-9dccbe7a2d26 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: TTP description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster diff --git a/detections/deprecated/identify_new_user_accounts.yml b/removed/detections/identify_new_user_accounts.yml similarity index 98% rename from detections/deprecated/identify_new_user_accounts.yml rename to removed/detections/identify_new_user_accounts.yml index 55b528d72a..89e8250b82 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/removed/detections/identify_new_user_accounts.yml @@ -3,7 +3,7 @@ id: 475b9e27-17e4-46e2-b7e2-648221be3b89 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the diff --git a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml rename to removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index 8aed9288a5..20458780df 100644 --- a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml b/removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml rename to removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml index 6d04bf8d94..5f424be025 100644 --- a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml +++ b/removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml @@ -3,7 +3,7 @@ id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/removed/detections/kubernetes_aws_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_aws_detect_sensitive_role_access.yml index bb7b707a96..ed19c6d3f0 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_aws_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: b6013a7b-85e0-4a45-b051-10b252d69569 version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index 17722e0587..9dd04f706e 100644 --- a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: a6959c57-fa8f-4277-bb86-7c32fba579d5 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml b/removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml rename to removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml index ef9d02ecbe..900b6fd517 100644 --- a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml +++ b/removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml @@ -3,7 +3,7 @@ id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb diff --git a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml b/removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml rename to removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml index 0adc47769d..a40aa3b80e 100644 --- a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -3,7 +3,7 @@ id: 47af7d20-0607-4079-97d7-7a29af58b54e version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml b/removed/detections/kubernetes_azure_detect_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml rename to removed/detections/kubernetes_azure_detect_sensitive_object_access.yml index 8ae1ee647e..d06b658319 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml +++ b/removed/detections/kubernetes_azure_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/removed/detections/kubernetes_azure_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_azure_detect_sensitive_role_access.yml index 9993a0a115..a42d6e5acd 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_azure_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: f27349e5-1641-4f6a-9e68-30402be0ad4c version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index ccbf5daf0c..502f1644b6 100644 --- a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 019690d7-420f-4da0-b320-f27b09961514 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status diff --git a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml rename to removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml index ef3fed2b2d..f213575ef1 100644 --- a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on rare Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml b/removed/detections/kubernetes_azure_pod_scan_fingerprint.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml rename to removed/detections/kubernetes_azure_pod_scan_fingerprint.yml index 1b1378b2f7..715ad90996 100644 --- a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml +++ b/removed/detections/kubernetes_azure_pod_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: 86aad3e0-732f-4f66-bbbc-70df448e461d version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod diff --git a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml b/removed/detections/kubernetes_azure_scan_fingerprint.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_scan_fingerprint.yml rename to removed/detections/kubernetes_azure_scan_fingerprint.yml index 8a6b44473d..1604bee2ce 100644 --- a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml +++ b/removed/detections/kubernetes_azure_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: c5e5bd5c-1013-4841-8b23-e7b3253c840a version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in diff --git a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml rename to removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index 0d3a4cdf11..32d73fe7a4 100644 --- a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml b/removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml rename to removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml index 09a26684ce..a73ac757ba 100644 --- a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml +++ b/removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml @@ -3,7 +3,7 @@ id: 99487de3-7192-4b41-939d-fbe9acfb1340 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml b/removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml rename to removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml index 557ab8a5c3..f6d58fb55d 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: bdb6d596-86a0-4aba-8369-418ae8b9963a version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml b/removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml index da1b2cf148..97f65baf4a 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: a46923f6-36b9-4806-a681-31f314907c30 version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index fff4730076..830d71836c 100644 --- a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 7094808d-432a-48e7-bb3c-77e96c894f3b version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml rename to removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index a78e967c70..d3893b3ba1 100644 --- a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: a5bed417-070a-41f2-a1e4-82b6aa281557 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/linux_auditd_find_private_keys.yml b/removed/detections/linux_auditd_find_private_keys.yml similarity index 99% rename from detections/deprecated/linux_auditd_find_private_keys.yml rename to removed/detections/linux_auditd_find_private_keys.yml index d45b98a890..225211371a 100644 --- a/detections/deprecated/linux_auditd_find_private_keys.yml +++ b/removed/detections/linux_auditd_find_private_keys.yml @@ -3,7 +3,7 @@ id: 80bb9988-190b-4ee0-a3c3-509545a8f678 version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort diff --git a/detections/deprecated/local_account_discovery_with_net.yml b/removed/detections/local_account_discovery_with_net.yml similarity index 99% rename from detections/deprecated/local_account_discovery_with_net.yml rename to removed/detections/local_account_discovery_with_net.yml index 69f3af6598..2203098764 100644 --- a/detections/deprecated/local_account_discovery_with_net.yml +++ b/removed/detections/local_account_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 5d0d4830-0133-11ec-bae3-acde48001122 version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/removed/detections/monitor_dns_for_brand_abuse.yml similarity index 98% rename from detections/deprecated/monitor_dns_for_brand_abuse.yml rename to removed/detections/monitor_dns_for_brand_abuse.yml index 9ad520f284..23a96ac7d0 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/removed/detections/monitor_dns_for_brand_abuse.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. diff --git a/detections/deprecated/mshtml_module_load_in_office_product.yml b/removed/detections/mshtml_module_load_in_office_product.yml similarity index 99% rename from detections/deprecated/mshtml_module_load_in_office_product.yml rename to removed/detections/mshtml_module_load_in_office_product.yml index 833a24a872..03be60e1c7 100644 --- a/detections/deprecated/mshtml_module_load_in_office_product.yml +++ b/removed/detections/mshtml_module_load_in_office_product.yml @@ -3,7 +3,7 @@ id: 5f1c168e-118b-11ec-84ff-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative diff --git a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml similarity index 99% rename from detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml rename to removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml index 1ebadf8ebc..96b3b69893 100644 --- a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml +++ b/removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml @@ -3,7 +3,7 @@ id: 19cba45f-cad3-4032-8911-0c09e0444552 version: 6 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Users Failing To Authenticate From Ip`. This analytic identifies diff --git a/detections/deprecated/net_localgroup_discovery.yml b/removed/detections/net_localgroup_discovery.yml similarity index 99% rename from detections/deprecated/net_localgroup_discovery.yml rename to removed/detections/net_localgroup_discovery.yml index 31b775f015..261b7b7902 100644 --- a/detections/deprecated/net_localgroup_discovery.yml +++ b/removed/detections/net_localgroup_discovery.yml @@ -3,7 +3,7 @@ id: 54f5201e-155b-11ec-a6e2-acde48001122 version: 6 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic detects the execution diff --git a/detections/deprecated/network_connection_discovery_with_net.yml b/removed/detections/network_connection_discovery_with_net.yml similarity index 99% rename from detections/deprecated/network_connection_discovery_with_net.yml rename to removed/detections/network_connection_discovery_with_net.yml index 0002699f31..b90d9bdde6 100644 --- a/detections/deprecated/network_connection_discovery_with_net.yml +++ b/removed/detections/network_connection_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d version: 6 date: '2025-01-24' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` diff --git a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml b/removed/detections/o365_suspicious_admin_email_forwarding.yml similarity index 98% rename from detections/deprecated/o365_suspicious_admin_email_forwarding.yml rename to removed/detections/o365_suspicious_admin_email_forwarding.yml index b706b2d0a8..7d67c799b3 100644 --- a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml +++ b/removed/detections/o365_suspicious_admin_email_forwarding.yml @@ -3,7 +3,7 @@ id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`. This search detects when an admin diff --git a/detections/deprecated/o365_suspicious_rights_delegation.yml b/removed/detections/o365_suspicious_rights_delegation.yml similarity index 99% rename from detections/deprecated/o365_suspicious_rights_delegation.yml rename to removed/detections/o365_suspicious_rights_delegation.yml index 716fd6289c..f2ed6c205b 100644 --- a/detections/deprecated/o365_suspicious_rights_delegation.yml +++ b/removed/detections/o365_suspicious_rights_delegation.yml @@ -3,7 +3,7 @@ id: b25d2973-303e-47c8-bacd-52b61604c6a7 version: 5 date: '2025-02-10' author: Patrick Bareiss, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Elevated Mailbox Permission Assigned`. This analytic identifies instances diff --git a/detections/deprecated/o365_suspicious_user_email_forwarding.yml b/removed/detections/o365_suspicious_user_email_forwarding.yml similarity index 99% rename from detections/deprecated/o365_suspicious_user_email_forwarding.yml rename to removed/detections/o365_suspicious_user_email_forwarding.yml index 4ea5ecc88d..534b319903 100644 --- a/detections/deprecated/o365_suspicious_user_email_forwarding.yml +++ b/removed/detections/o365_suspicious_user_email_forwarding.yml @@ -3,7 +3,7 @@ id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 5 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`. The following analytic detects when diff --git a/detections/deprecated/office_application_drop_executable.yml b/removed/detections/office_application_drop_executable.yml similarity index 99% rename from detections/deprecated/office_application_drop_executable.yml rename to removed/detections/office_application_drop_executable.yml index c87210ccf6..6289572cc2 100644 --- a/detections/deprecated/office_application_drop_executable.yml +++ b/removed/detections/office_application_drop_executable.yml @@ -3,7 +3,7 @@ id: 73ce70c4-146d-11ec-9184-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows diff --git a/detections/deprecated/office_application_spawn_regsvr32_process.yml b/removed/detections/office_application_spawn_regsvr32_process.yml similarity index 99% rename from detections/deprecated/office_application_spawn_regsvr32_process.yml rename to removed/detections/office_application_spawn_regsvr32_process.yml index 8aa07a2de3..305da934ed 100644 --- a/detections/deprecated/office_application_spawn_regsvr32_process.yml +++ b/removed/detections/office_application_spawn_regsvr32_process.yml @@ -3,7 +3,7 @@ id: 2d9fc90c-f11f-11eb-9300-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_application_spawn_rundll32_process.yml b/removed/detections/office_application_spawn_rundll32_process.yml similarity index 99% rename from detections/deprecated/office_application_spawn_rundll32_process.yml rename to removed/detections/office_application_spawn_rundll32_process.yml index e648095cc9..6fb15cde36 100644 --- a/detections/deprecated/office_application_spawn_rundll32_process.yml +++ b/removed/detections/office_application_spawn_rundll32_process.yml @@ -3,7 +3,7 @@ id: 958751e4-9c5f-11eb-b103-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_document_creating_schedule_task.yml b/removed/detections/office_document_creating_schedule_task.yml similarity index 99% rename from detections/deprecated/office_document_creating_schedule_task.yml rename to removed/detections/office_document_creating_schedule_task.yml index ef59131ecc..75fbcf448d 100644 --- a/detections/deprecated/office_document_creating_schedule_task.yml +++ b/removed/detections/office_document_creating_schedule_task.yml @@ -3,7 +3,7 @@ id: cc8b7b74-9d0f-11eb-8342-acde48001122 version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or diff --git a/detections/deprecated/office_document_executing_macro_code.yml b/removed/detections/office_document_executing_macro_code.yml similarity index 99% rename from detections/deprecated/office_document_executing_macro_code.yml rename to removed/detections/office_document_executing_macro_code.yml index 8d74ea1aa2..503de3d2b6 100644 --- a/detections/deprecated/office_document_executing_macro_code.yml +++ b/removed/detections/office_document_executing_macro_code.yml @@ -3,7 +3,7 @@ id: b12c89bc-9d06-11eb-a592-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect diff --git a/detections/deprecated/office_document_spawned_child_process_to_download.yml b/removed/detections/office_document_spawned_child_process_to_download.yml similarity index 99% rename from detections/deprecated/office_document_spawned_child_process_to_download.yml rename to removed/detections/office_document_spawned_child_process_to_download.yml index 2e78ed372c..9579d186f0 100644 --- a/detections/deprecated/office_document_spawned_child_process_to_download.yml +++ b/removed/detections/office_document_spawned_child_process_to_download.yml @@ -3,7 +3,7 @@ id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. diff --git a/detections/deprecated/office_product_spawn_cmd_process.yml b/removed/detections/office_product_spawn_cmd_process.yml similarity index 99% rename from detections/deprecated/office_product_spawn_cmd_process.yml rename to removed/detections/office_product_spawn_cmd_process.yml index 4893d60d9f..949962d43e 100644 --- a/detections/deprecated/office_product_spawn_cmd_process.yml +++ b/removed/detections/office_product_spawn_cmd_process.yml @@ -3,7 +3,7 @@ id: b8b19420-e892-11eb-9244-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_bitsadmin.yml b/removed/detections/office_product_spawning_bitsadmin.yml similarity index 99% rename from detections/deprecated/office_product_spawning_bitsadmin.yml rename to removed/detections/office_product_spawning_bitsadmin.yml index 28ee0cc811..e4a1cd88ff 100644 --- a/detections/deprecated/office_product_spawning_bitsadmin.yml +++ b/removed/detections/office_product_spawning_bitsadmin.yml @@ -3,7 +3,7 @@ id: e8c591f4-a6d7-11eb-8cf7-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_certutil.yml b/removed/detections/office_product_spawning_certutil.yml similarity index 99% rename from detections/deprecated/office_product_spawning_certutil.yml rename to removed/detections/office_product_spawning_certutil.yml index 698343c8ae..d1819873df 100644 --- a/detections/deprecated/office_product_spawning_certutil.yml +++ b/removed/detections/office_product_spawning_certutil.yml @@ -3,7 +3,7 @@ id: 6925fe72-a6d5-11eb-9e17-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_mshta.yml b/removed/detections/office_product_spawning_mshta.yml similarity index 99% rename from detections/deprecated/office_product_spawning_mshta.yml rename to removed/detections/office_product_spawning_mshta.yml index 9c8c8ae1ce..e21d9688c5 100644 --- a/detections/deprecated/office_product_spawning_mshta.yml +++ b/removed/detections/office_product_spawning_mshta.yml @@ -3,7 +3,7 @@ id: 6078fa20-a6d2-11eb-b662-acde48001122 version: 9 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml b/removed/detections/office_product_spawning_rundll32_with_no_dll.yml similarity index 99% rename from detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml rename to removed/detections/office_product_spawning_rundll32_with_no_dll.yml index 41f3f9df66..2e4c38fdd5 100644 --- a/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml +++ b/removed/detections/office_product_spawning_rundll32_with_no_dll.yml @@ -3,7 +3,7 @@ id: c661f6be-a38c-11eb-be57-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. diff --git a/detections/deprecated/office_product_spawning_windows_script_host.yml b/removed/detections/office_product_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/office_product_spawning_windows_script_host.yml rename to removed/detections/office_product_spawning_windows_script_host.yml index b4da3bfa8e..b33dc038c5 100644 --- a/detections/deprecated/office_product_spawning_windows_script_host.yml +++ b/removed/detections/office_product_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 version: 12 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_wmic.yml b/removed/detections/office_product_spawning_wmic.yml similarity index 99% rename from detections/deprecated/office_product_spawning_wmic.yml rename to removed/detections/office_product_spawning_wmic.yml index 0e60c6e32f..f8f0be00c5 100644 --- a/detections/deprecated/office_product_spawning_wmic.yml +++ b/removed/detections/office_product_spawning_wmic.yml @@ -3,7 +3,7 @@ id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_writing_cab_or_inf.yml b/removed/detections/office_product_writing_cab_or_inf.yml similarity index 99% rename from detections/deprecated/office_product_writing_cab_or_inf.yml rename to removed/detections/office_product_writing_cab_or_inf.yml index 9d29d2a888..7b6f06bb42 100644 --- a/detections/deprecated/office_product_writing_cab_or_inf.yml +++ b/removed/detections/office_product_writing_cab_or_inf.yml @@ -3,7 +3,7 @@ id: f48cd1d4-125a-11ec-a447-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. diff --git a/detections/deprecated/office_spawning_control.yml b/removed/detections/office_spawning_control.yml similarity index 99% rename from detections/deprecated/office_spawning_control.yml rename to removed/detections/office_spawning_control.yml index f141b89519..37487e24a7 100644 --- a/detections/deprecated/office_spawning_control.yml +++ b/removed/detections/office_spawning_control.yml @@ -3,7 +3,7 @@ id: 053e027c-10c7-11ec-8437-acde48001122 version: 12 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies instances where `control.exe` is spawned by a Microsoft Office product. It leverages diff --git a/detections/deprecated/okta_account_locked_out.yml b/removed/detections/okta_account_locked_out.yml similarity index 99% rename from detections/deprecated/okta_account_locked_out.yml rename to removed/detections/okta_account_locked_out.yml index 0ad8243973..827f3fd86a 100644 --- a/detections/deprecated/okta_account_locked_out.yml +++ b/removed/detections/okta_account_locked_out.yml @@ -3,7 +3,7 @@ id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1 version: 3 date: '2024-11-14' author: Michael Haag, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following analytic utilizes the user.acount.lock diff --git a/detections/deprecated/okta_account_lockout_events.yml b/removed/detections/okta_account_lockout_events.yml similarity index 99% rename from detections/deprecated/okta_account_lockout_events.yml rename to removed/detections/okta_account_lockout_events.yml index b2ec1f14ef..cacf38cb37 100644 --- a/detections/deprecated/okta_account_lockout_events.yml +++ b/removed/detections/okta_account_lockout_events.yml @@ -3,7 +3,7 @@ id: 62b70968-a0a5-4724-8ac4-67871e6f544d version: 5 date: '2025-02-10' author: Michael Haag, Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following anomaly will generate based diff --git a/detections/deprecated/okta_failed_sso_attempts.yml b/removed/detections/okta_failed_sso_attempts.yml similarity index 98% rename from detections/deprecated/okta_failed_sso_attempts.yml rename to removed/detections/okta_failed_sso_attempts.yml index 3c1d92c759..7ab6ebad6c 100644 --- a/detections/deprecated/okta_failed_sso_attempts.yml +++ b/removed/detections/okta_failed_sso_attempts.yml @@ -3,7 +3,7 @@ id: 371a6545-2618-4032-ad84-93386b8698c5 version: 6 date: '2025-02-10' author: Michael Haag, Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with this detection `Okta Unauthorized Access to Application - DM`. The following diff --git a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml b/removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml similarity index 98% rename from detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml rename to removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml index 00af9d0aa5..865053caa9 100644 --- a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml +++ b/removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml @@ -4,7 +4,7 @@ version: 5 date: '2025-02-10' author: Okta, Inc, Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: [] description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas diff --git a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml b/removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml similarity index 98% rename from detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml rename to removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml index e68cf87729..4a6f29d878 100644 --- a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml @@ -4,7 +4,7 @@ version: 5 date: '2025-02-10' author: Okta, Inc, Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: [] description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas diff --git a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml b/removed/detections/okta_two_or_more_rejected_okta_pushes.yml similarity index 99% rename from detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml rename to removed/detections/okta_two_or_more_rejected_okta_pushes.yml index 9817b5f845..cd09e9e972 100644 --- a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml +++ b/removed/detections/okta_two_or_more_rejected_okta_pushes.yml @@ -3,7 +3,7 @@ id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 version: 4 date: '2024-11-14' author: Michael Haag, Marissa Bower, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Failed MFA Requests For User`. The following analytic identifies diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/removed/detections/osquery_pack___coldroot_detection.yml similarity index 98% rename from detections/deprecated/osquery_pack___coldroot_detection.yml rename to removed/detections/osquery_pack___coldroot_detection.yml index 369173b8fd..7b3a494261 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/removed/detections/osquery_pack___coldroot_detection.yml @@ -3,7 +3,7 @@ id: a6fffe5e-05c3-4c04-badc-887607fbb8dc version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for ColdRoot events from the osx-attacks osquery pack. data_source: [] diff --git a/detections/deprecated/password_policy_discovery_with_net.yml b/removed/detections/password_policy_discovery_with_net.yml similarity index 99% rename from detections/deprecated/password_policy_discovery_with_net.yml rename to removed/detections/password_policy_discovery_with_net.yml index 0656e661c8..527907ea6f 100644 --- a/detections/deprecated/password_policy_discovery_with_net.yml +++ b/removed/detections/password_policy_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 09336538-065a-11ec-8665-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` diff --git a/detections/deprecated/processes_created_by_netsh.yml b/removed/detections/processes_created_by_netsh.yml similarity index 99% rename from detections/deprecated/processes_created_by_netsh.yml rename to removed/detections/processes_created_by_netsh.yml index cb947299d8..a7ff65c024 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/removed/detections/processes_created_by_netsh.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162041e version: 8 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/removed/detections/prohibited_software_on_endpoint.yml similarity index 98% rename from detections/deprecated/prohibited_software_on_endpoint.yml rename to removed/detections/prohibited_software_on_endpoint.yml index 243c1c8374..0572b6f2bf 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/removed/detections/prohibited_software_on_endpoint.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for applications on the endpoint that you have marked as prohibited. diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml similarity index 99% rename from detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml rename to removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index b003f3bd58..bc776d7e9a 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -3,7 +3,7 @@ id: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The search looks for command-line arguments used to hide a file or directory using the reg add command. diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/removed/detections/remote_registry_key_modifications.yml similarity index 98% rename from detections/deprecated/remote_registry_key_modifications.yml rename to removed/detections/remote_registry_key_modifications.yml index 71f902a8ad..ffd7eff675 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/removed/detections/remote_registry_key_modifications.yml @@ -3,7 +3,7 @@ id: c9f4b923-f8af-4155-b697-1354f5dcbc5e version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search monitors for remote modifications to registry keys. data_source: diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/removed/detections/remote_system_discovery_with_net.yml similarity index 99% rename from detections/deprecated/remote_system_discovery_with_net.yml rename to removed/detections/remote_system_discovery_with_net.yml index 2377264b52..8961d33627 100644 --- a/detections/deprecated/remote_system_discovery_with_net.yml +++ b/removed/detections/remote_system_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 version: 5 date: '2025-01-13' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. data_source: diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml similarity index 99% rename from detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml rename to removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml index 0197ba45a3..19aaa1b2c4 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/removed/detections/spectre_and_meltdown_vulnerable_systems.yml similarity index 98% rename from detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml rename to removed/detections/spectre_and_meltdown_vulnerable_systems.yml index 1f4a043402..1859af0f86 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/removed/detections/spectre_and_meltdown_vulnerable_systems.yml @@ -3,7 +3,7 @@ id: 354be8e0-32cd-4da0-8c47-796de13b60ea version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities. diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/removed/detections/suspicious_changes_to_file_associations.yml similarity index 99% rename from detections/deprecated/suspicious_changes_to_file_associations.yml rename to removed/detections/suspicious_changes_to_file_associations.yml index e9438be5a1..9b9a6fa348 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/removed/detections/suspicious_changes_to_file_associations.yml @@ -3,7 +3,7 @@ id: 1b989a0e-0129-4446-a695-f193a5b746fc version: 7 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine diff --git a/detections/deprecated/suspicious_email___uba_anomaly.yml b/removed/detections/suspicious_email___uba_anomaly.yml similarity index 99% rename from detections/deprecated/suspicious_email___uba_anomaly.yml rename to removed/detections/suspicious_email___uba_anomaly.yml index 0e3a3f31d6..7399390137 100644 --- a/detections/deprecated/suspicious_email___uba_anomaly.yml +++ b/removed/detections/suspicious_email___uba_anomaly.yml @@ -3,7 +3,7 @@ id: 56e877a6-1455-4479-ad16-0550dc1e33f8 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by diff --git a/detections/deprecated/suspicious_file_write.yml b/removed/detections/suspicious_file_write.yml similarity index 99% rename from detections/deprecated/suspicious_file_write.yml rename to removed/detections/suspicious_file_write.yml index 8630632e57..12e9533132 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/removed/detections/suspicious_file_write.yml @@ -3,7 +3,7 @@ id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 version: 6 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Hunting description: The search looks for files created with names that have been linked to malicious activity. diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/removed/detections/suspicious_powershell_command_line_arguments.yml similarity index 99% rename from detections/deprecated/suspicious_powershell_command_line_arguments.yml rename to removed/detections/suspicious_powershell_command_line_arguments.yml index b2efc4ee51..c7a8ffa35b 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/removed/detections/suspicious_powershell_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 2cdb91d2-542c-497f-b252-be495e71f38c version: 9 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/removed/detections/suspicious_rundll32_rename.yml similarity index 99% rename from detections/deprecated/suspicious_rundll32_rename.yml rename to removed/detections/suspicious_rundll32_rename.yml index eee4228129..81ead5651f 100644 --- a/detections/deprecated/suspicious_rundll32_rename.yml +++ b/removed/detections/suspicious_rundll32_rename.yml @@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following hunting analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/removed/detections/suspicious_writes_to_system_volume_information.yml similarity index 98% rename from detections/deprecated/suspicious_writes_to_system_volume_information.yml rename to removed/detections/suspicious_writes_to_system_volume_information.yml index 866160575b..e9c1f20721 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/removed/detections/suspicious_writes_to_system_volume_information.yml @@ -3,7 +3,7 @@ id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Hunting description: This search detects writes to the 'System Volume Information' folder by something other than the System process. diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/removed/detections/uncommon_processes_on_endpoint.yml similarity index 98% rename from detections/deprecated/uncommon_processes_on_endpoint.yml rename to removed/detections/uncommon_processes_on_endpoint.yml index e0378b0e1f..fa6e1d6c2d 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/removed/detections/uncommon_processes_on_endpoint.yml @@ -3,7 +3,7 @@ id: 29ccce64-a10c-4389-a45f-337cb29ba1f7 version: 7 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for applications on the endpoint that you have marked as uncommon. diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/removed/detections/unsigned_image_loaded_by_lsass.yml similarity index 98% rename from detections/deprecated/unsigned_image_loaded_by_lsass.yml rename to removed/detections/unsigned_image_loaded_by_lsass.yml index db021a2bf3..bda913376f 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/removed/detections/unsigned_image_loaded_by_lsass.yml @@ -3,7 +3,7 @@ id: 56ef054c-76ef-45f9-af4a-a634695dcd65 version: 4 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: This search detects loading of unsigned images by LSASS. Deprecated because too noisy. diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/removed/detections/unsuccessful_netbackup_backups.yml similarity index 98% rename from detections/deprecated/unsuccessful_netbackup_backups.yml rename to removed/detections/unsuccessful_netbackup_backups.yml index 3e8fc0b5af..afa6f95673 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/removed/detections/unsuccessful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aaa-952c-3ea21444444f version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search gives you the hosts where a backup was attempted and then failed. diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/removed/detections/web_fraud___account_harvesting.yml similarity index 99% rename from detections/deprecated/web_fraud___account_harvesting.yml rename to removed/detections/web_fraud___account_harvesting.yml index 4fb3b3b784..ba78a3fa1a 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/removed/detections/web_fraud___account_harvesting.yml @@ -3,7 +3,7 @@ id: bf1d7b5c-df2f-4249-a401-c09fdc221ddf version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: TTP description: This search is used to identify the creation of multiple user accounts using the same email domain name. diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/removed/detections/web_fraud___anomalous_user_clickspeed.yml similarity index 99% rename from detections/deprecated/web_fraud___anomalous_user_clickspeed.yml rename to removed/detections/web_fraud___anomalous_user_clickspeed.yml index 518a5be28e..c084525674 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/removed/detections/web_fraud___anomalous_user_clickspeed.yml @@ -3,7 +3,7 @@ id: 31337bbb-bc22-4752-b599-ef192df2dc7a version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: Anomaly description: This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/removed/detections/web_fraud___password_sharing_across_accounts.yml similarity index 98% rename from detections/deprecated/web_fraud___password_sharing_across_accounts.yml rename to removed/detections/web_fraud___password_sharing_across_accounts.yml index 48c9b3908c..c1ac8d3080 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/removed/detections/web_fraud___password_sharing_across_accounts.yml @@ -3,7 +3,7 @@ id: 31337a1a-53b9-4e05-96e9-55c934cb71d3 version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: Anomaly description: This search is used to identify user accounts that share a common password. data_source: [] diff --git a/detections/deprecated/windows_command_shell_fetch_env_variables.yml b/removed/detections/windows_command_shell_fetch_env_variables.yml similarity index 99% rename from detections/deprecated/windows_command_shell_fetch_env_variables.yml rename to removed/detections/windows_command_shell_fetch_env_variables.yml index 90618ba3e5..f604adbab8 100644 --- a/detections/deprecated/windows_command_shell_fetch_env_variables.yml +++ b/removed/detections/windows_command_shell_fetch_env_variables.yml @@ -3,7 +3,7 @@ id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies a suspicious process command line fetching diff --git a/detections/deprecated/windows_connhost_exe_started_forcefully.yml b/removed/detections/windows_connhost_exe_started_forcefully.yml similarity index 99% rename from detections/deprecated/windows_connhost_exe_started_forcefully.yml rename to removed/detections/windows_connhost_exe_started_forcefully.yml index 2718083864..5574cb0440 100644 --- a/detections/deprecated/windows_connhost_exe_started_forcefully.yml +++ b/removed/detections/windows_connhost_exe_started_forcefully.yml @@ -3,7 +3,7 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769 version: 5 date: '2024-11-14' author: Rod Soto, Jose Hernandez, Splunk -status: deprecated +status: removed type: TTP description: The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and diff --git a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml b/removed/detections/windows_dll_search_order_hijacking_hunt.yml similarity index 99% rename from detections/deprecated/windows_dll_search_order_hijacking_hunt.yml rename to removed/detections/windows_dll_search_order_hijacking_hunt.yml index 6149fc746d..a2b4d5bffc 100644 --- a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml +++ b/removed/detections/windows_dll_search_order_hijacking_hunt.yml @@ -3,7 +3,7 @@ id: 79c7d0fc-60c7-41be-a616-ccda752efe89 version: 6 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/removed/detections/windows_hosts_file_modification.yml similarity index 98% rename from detections/deprecated/windows_hosts_file_modification.yml rename to removed/detections/windows_hosts_file_modification.yml index 0c7453eab3..7f40e5ea32 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/removed/detections/windows_hosts_file_modification.yml @@ -3,7 +3,7 @@ id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 version: 4 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The search looks for modifications to the hosts file on all Windows endpoints across your environment. diff --git a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml b/removed/detections/windows_lateral_tool_transfer_remcom.yml similarity index 99% rename from detections/deprecated/windows_lateral_tool_transfer_remcom.yml rename to removed/detections/windows_lateral_tool_transfer_remcom.yml index 47789c6b30..e1d64bf004 100644 --- a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml +++ b/removed/detections/windows_lateral_tool_transfer_remcom.yml @@ -4,7 +4,7 @@ version: 6 date: '2024-12-10' author: Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/deprecated/windows_modify_registry_reg_restore.yml b/removed/detections/windows_modify_registry_reg_restore.yml similarity index 99% rename from detections/deprecated/windows_modify_registry_reg_restore.yml rename to removed/detections/windows_modify_registry_reg_restore.yml index f63d1b0214..8045b06c1e 100644 --- a/detections/deprecated/windows_modify_registry_reg_restore.yml +++ b/removed/detections/windows_modify_registry_reg_restore.yml @@ -3,7 +3,7 @@ id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of reg.exe with the "restore" diff --git a/detections/deprecated/windows_msiexec_with_network_connections.yml b/removed/detections/windows_msiexec_with_network_connections.yml similarity index 99% rename from detections/deprecated/windows_msiexec_with_network_connections.yml rename to removed/detections/windows_msiexec_with_network_connections.yml index 5c17518468..e8ace70d6d 100644 --- a/detections/deprecated/windows_msiexec_with_network_connections.yml +++ b/removed/detections/windows_msiexec_with_network_connections.yml @@ -3,7 +3,7 @@ id: 827409a1-5393-4d8d-8da4-bbb297c262a7 version: 7 date: '2025-01-24' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects MSIExec making network connections over diff --git a/detections/deprecated/windows_network_share_interaction_with_net.yml b/removed/detections/windows_network_share_interaction_with_net.yml similarity index 99% rename from detections/deprecated/windows_network_share_interaction_with_net.yml rename to removed/detections/windows_network_share_interaction_with_net.yml index fea71519c1..d07e5475c4 100644 --- a/detections/deprecated/windows_network_share_interaction_with_net.yml +++ b/removed/detections/windows_network_share_interaction_with_net.yml @@ -3,7 +3,7 @@ id: 4dc3951f-b3f8-4f46-b412-76a483f72277 version: 6 date: '2025-01-24' author: Dean Luxton -status: deprecated +status: removed type: TTP data_source: - Sysmon EventID 1 diff --git a/detections/deprecated/windows_office_product_spawning_msdt.yml b/removed/detections/windows_office_product_spawning_msdt.yml similarity index 99% rename from detections/deprecated/windows_office_product_spawning_msdt.yml rename to removed/detections/windows_office_product_spawning_msdt.yml index 9415352231..7938c379ea 100644 --- a/detections/deprecated/windows_office_product_spawning_msdt.yml +++ b/removed/detections/windows_office_product_spawning_msdt.yml @@ -3,7 +3,7 @@ id: 127eba64-c981-40bf-8589-1830638864a7 version: 11 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This detection diff --git a/detections/deprecated/windows_query_registry_reg_save.yml b/removed/detections/windows_query_registry_reg_save.yml similarity index 99% rename from detections/deprecated/windows_query_registry_reg_save.yml rename to removed/detections/windows_query_registry_reg_save.yml index 291c0cf7a0..b72b968b31 100644 --- a/detections/deprecated/windows_query_registry_reg_save.yml +++ b/removed/detections/windows_query_registry_reg_save.yml @@ -3,7 +3,7 @@ id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 version: 6 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of the reg.exe process with diff --git a/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml b/removed/detections/windows_service_stop_via_net__and_sc_application.yml similarity index 99% rename from detections/deprecated/windows_service_stop_via_net__and_sc_application.yml rename to removed/detections/windows_service_stop_via_net__and_sc_application.yml index 00ff416650..2a90df0a04 100644 --- a/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml +++ b/removed/detections/windows_service_stop_via_net__and_sc_application.yml @@ -3,7 +3,7 @@ id: 827af04b-0d08-479b-9b84-b7d4644e4b80 version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic identifies attempts to stop services on a system diff --git a/detections/deprecated/windows_valid_account_with_never_expires_password.yml b/removed/detections/windows_valid_account_with_never_expires_password.yml similarity index 99% rename from detections/deprecated/windows_valid_account_with_never_expires_password.yml rename to removed/detections/windows_valid_account_with_never_expires_password.yml index 01b416d1d5..3e3a6be6b4 100644 --- a/detections/deprecated/windows_valid_account_with_never_expires_password.yml +++ b/removed/detections/windows_valid_account_with_never_expires_password.yml @@ -3,7 +3,7 @@ id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 version: 6 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of net.exe to update user account diff --git a/detections/deprecated/winword_spawning_cmd.yml b/removed/detections/winword_spawning_cmd.yml similarity index 99% rename from detections/deprecated/winword_spawning_cmd.yml rename to removed/detections/winword_spawning_cmd.yml index 2d65e01f22..b9ec89bd35 100644 --- a/detections/deprecated/winword_spawning_cmd.yml +++ b/removed/detections/winword_spawning_cmd.yml @@ -3,7 +3,7 @@ id: 6fcbaedc-a37b-11eb-956b-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/winword_spawning_powershell.yml b/removed/detections/winword_spawning_powershell.yml similarity index 99% rename from detections/deprecated/winword_spawning_powershell.yml rename to removed/detections/winword_spawning_powershell.yml index 4164d64cf7..d9dd1b7902 100644 --- a/detections/deprecated/winword_spawning_powershell.yml +++ b/removed/detections/winword_spawning_powershell.yml @@ -3,7 +3,7 @@ id: b2c950b8-9be2-11eb-8658-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/winword_spawning_windows_script_host.yml b/removed/detections/winword_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/winword_spawning_windows_script_host.yml rename to removed/detections/winword_spawning_windows_script_host.yml index 47feee0635..736daa38b8 100644 --- a/detections/deprecated/winword_spawning_windows_script_host.yml +++ b/removed/detections/winword_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 637e1b5c-9be1-11eb-9c32-acde48001122 version: 7 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Winword.exe diff --git a/investigations/all_backup_logs_for_host.yml b/removed/investigations/all_backup_logs_for_host.yml similarity index 96% rename from investigations/all_backup_logs_for_host.yml rename to removed/investigations/all_backup_logs_for_host.yml index 526e0760f2..b6bfc3dfb0 100644 --- a/investigations/all_backup_logs_for_host.yml +++ b/removed/investigations/all_backup_logs_for_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-12' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. search: '| search `netbackup` dest=$dest$' diff --git a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml b/removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml similarity index 98% rename from investigations/amazon_eks_kubernetes_activity_by_src_ip.yml rename to removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml index fdd85fd8e0..e1462cd64e 100644 --- a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation -status: deprecated +status: removed description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/aws_investigate_security_hub_alerts_by_dest.yml b/removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml similarity index 98% rename from investigations/aws_investigate_security_hub_alerts_by_dest.yml rename to removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml index c68fadb66c..2159c1a135 100644 --- a/investigations/aws_investigate_security_hub_alerts_by_dest.yml +++ b/removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-06-08' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | diff --git a/investigations/aws_investigate_user_activities_by_accesskeyid.yml b/removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml similarity index 98% rename from investigations/aws_investigate_user_activities_by_accesskeyid.yml rename to removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml index c9523dd2fd..59a95196e1 100644 --- a/investigations/aws_investigate_user_activities_by_accesskeyid.yml +++ b/removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-08' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ diff --git a/investigations/aws_investigate_user_activities_by_arn.yml b/removed/investigations/aws_investigate_user_activities_by_arn.yml similarity index 98% rename from investigations/aws_investigate_user_activities_by_arn.yml rename to removed/investigations/aws_investigate_user_activities_by_arn.yml index d15290547a..4646dfe30a 100644 --- a/investigations/aws_investigate_user_activities_by_arn.yml +++ b/removed/investigations/aws_investigate_user_activities_by_arn.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-30' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's diff --git a/investigations/aws_network_acl_details_from_id.yml b/removed/investigations/aws_network_acl_details_from_id.yml similarity index 97% rename from investigations/aws_network_acl_details_from_id.yml rename to removed/investigations/aws_network_acl_details_from_id.yml index 71ef17baf8..de00a587d7 100644 --- a/investigations/aws_network_acl_details_from_id.yml +++ b/removed/investigations/aws_network_acl_details_from_id.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-01-22' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ diff --git a/investigations/aws_network_interface_details_via_resourceid.yml b/removed/investigations/aws_network_interface_details_via_resourceid.yml similarity index 98% rename from investigations/aws_network_interface_details_via_resourceid.yml rename to removed/investigations/aws_network_interface_details_via_resourceid.yml index 081ba1bdc4..6ae2a743e0 100644 --- a/investigations/aws_network_interface_details_via_resourceid.yml +++ b/removed/investigations/aws_network_interface_details_via_resourceid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, diff --git a/investigations/aws_s3_bucket_details_via_bucketname.yml b/removed/investigations/aws_s3_bucket_details_via_bucketname.yml similarity index 98% rename from investigations/aws_s3_bucket_details_via_bucketname.yml rename to removed/investigations/aws_s3_bucket_details_via_bucketname.yml index 86946b4438..30ba740556 100644 --- a/investigations/aws_s3_bucket_details_via_bucketname.yml +++ b/removed/investigations/aws_s3_bucket_details_via_bucketname.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-26' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, diff --git a/investigations/gcp_kubernetes_activity_by_src_ip.yml b/removed/investigations/gcp_kubernetes_activity_by_src_ip.yml similarity index 98% rename from investigations/gcp_kubernetes_activity_by_src_ip.yml rename to removed/investigations/gcp_kubernetes_activity_by_src_ip.yml index d4359faeb0..ea800a69ab 100644 --- a/investigations/gcp_kubernetes_activity_by_src_ip.yml +++ b/removed/investigations/gcp_kubernetes_activity_by_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation -status: deprecated +status: removed description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/get_all_aws_activity_from_city.yml b/removed/investigations/get_all_aws_activity_from_city.yml similarity index 98% rename from investigations/get_all_aws_activity_from_city.yml rename to removed/investigations/get_all_aws_activity_from_city.yml index 4e9d0f79a9..53a66d3aa7 100644 --- a/investigations/get_all_aws_activity_from_city.yml +++ b/removed/investigations/get_all_aws_activity_from_city.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_country.yml b/removed/investigations/get_all_aws_activity_from_country.yml similarity index 98% rename from investigations/get_all_aws_activity_from_country.yml rename to removed/investigations/get_all_aws_activity_from_country.yml index aef67b8395..de55cb7b02 100644 --- a/investigations/get_all_aws_activity_from_country.yml +++ b/removed/investigations/get_all_aws_activity_from_country.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether diff --git a/investigations/get_all_aws_activity_from_ip_address.yml b/removed/investigations/get_all_aws_activity_from_ip_address.yml similarity index 98% rename from investigations/get_all_aws_activity_from_ip_address.yml rename to removed/investigations/get_all_aws_activity_from_ip_address.yml index ad00e31621..52af123579 100644 --- a/investigations/get_all_aws_activity_from_ip_address.yml +++ b/removed/investigations/get_all_aws_activity_from_ip_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_region.yml b/removed/investigations/get_all_aws_activity_from_region.yml similarity index 98% rename from investigations/get_all_aws_activity_from_region.yml rename to removed/investigations/get_all_aws_activity_from_region.yml index a9be04ab63..383729b151 100644 --- a/investigations/get_all_aws_activity_from_region.yml +++ b/removed/investigations/get_all_aws_activity_from_region.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API diff --git a/investigations/get_backup_logs_for_endpoint.yml b/removed/investigations/get_backup_logs_for_endpoint.yml similarity index 97% rename from investigations/get_backup_logs_for_endpoint.yml rename to removed/investigations/get_backup_logs_for_endpoint.yml index 92c86ed03a..ba01f79f92 100644 --- a/investigations/get_backup_logs_for_endpoint.yml +++ b/removed/investigations/get_backup_logs_for_endpoint.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as diff --git a/investigations/get_certificate_logs_for_a_domain.yml b/removed/investigations/get_certificate_logs_for_a_domain.yml similarity index 98% rename from investigations/get_certificate_logs_for_a_domain.yml rename to removed/investigations/get_certificate_logs_for_a_domain.yml index f0b2aa4a3d..1dc65d87e5 100644 --- a/investigations/get_certificate_logs_for_a_domain.yml +++ b/removed/investigations/get_certificate_logs_for_a_domain.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-29' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. diff --git a/investigations/get_dns_server_history_for_a_host.yml b/removed/investigations/get_dns_server_history_for_a_host.yml similarity index 98% rename from investigations/get_dns_server_history_for_a_host.yml rename to removed/investigations/get_dns_server_history_for_a_host.yml index 58ba43d1c1..f6b7e5c1c0 100644 --- a/investigations/get_dns_server_history_for_a_host.yml +++ b/removed/investigations/get_dns_server_history_for_a_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular diff --git a/investigations/get_dns_traffic_ratio.yml b/removed/investigations/get_dns_traffic_ratio.yml similarity index 98% rename from investigations/get_dns_traffic_ratio.yml rename to removed/investigations/get_dns_traffic_ratio.yml index ede0480799..99247a4007 100644 --- a/investigations/get_dns_traffic_ratio.yml +++ b/removed/investigations/get_dns_traffic_ratio.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a diff --git a/investigations/get_ec2_instance_details_by_instanceid.yml b/removed/investigations/get_ec2_instance_details_by_instanceid.yml similarity index 98% rename from investigations/get_ec2_instance_details_by_instanceid.yml rename to removed/investigations/get_ec2_instance_details_by_instanceid.yml index ed0ddf0c52..800e16d849 100644 --- a/investigations/get_ec2_instance_details_by_instanceid.yml +++ b/removed/investigations/get_ec2_instance_details_by_instanceid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-02-12' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search diff --git a/investigations/get_ec2_launch_details.yml b/removed/investigations/get_ec2_launch_details.yml similarity index 98% rename from investigations/get_ec2_launch_details.yml rename to removed/investigations/get_ec2_launch_details.yml index 46432d9945..e9b715feb1 100644 --- a/investigations/get_ec2_launch_details.yml +++ b/removed/investigations/get_ec2_launch_details.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search returns some of the launch details for a EC2 instance. search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, diff --git a/investigations/get_email_info.yml b/removed/investigations/get_email_info.yml similarity index 97% rename from investigations/get_email_info.yml rename to removed/investigations/get_email_info.yml index 247576a7cc..fc572aad29 100644 --- a/investigations/get_email_info.yml +++ b/removed/investigations/get_email_info.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. search: '| from datamodel Email.All_Email | search message_id=$message_id$' diff --git a/investigations/get_emails_from_specific_sender.yml b/removed/investigations/get_emails_from_specific_sender.yml similarity index 97% rename from investigations/get_emails_from_specific_sender.yml rename to removed/investigations/get_emails_from_specific_sender.yml index c4e5b0389a..b10b60a45a 100644 --- a/investigations/get_emails_from_specific_sender.yml +++ b/removed/investigations/get_emails_from_specific_sender.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all the emails from a specific sender over the last 24 and next hours. search: '| from datamodel Email.All_Email | search src_user=$src_user$' diff --git a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml similarity index 98% rename from investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml rename to removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index 22da000f97..d1f48ff599 100644 --- a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with diff --git a/investigations/get_history_of_email_sources.yml b/removed/investigations/get_history_of_email_sources.yml similarity index 98% rename from investigations/get_history_of_email_sources.yml rename to removed/investigations/get_history_of_email_sources.yml index 6b5b7d83af..8b03896433 100644 --- a/investigations/get_history_of_email_sources.yml +++ b/removed/investigations/get_history_of_email_sources.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-02-21' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. diff --git a/investigations/get_logon_rights_modifications_for_endpoint.yml b/removed/investigations/get_logon_rights_modifications_for_endpoint.yml similarity index 97% rename from investigations/get_logon_rights_modifications_for_endpoint.yml rename to removed/investigations/get_logon_rights_modifications_for_endpoint.yml index 42405d395a..55a7a805d3 100644 --- a/investigations/get_logon_rights_modifications_for_endpoint.yml +++ b/removed/investigations/get_logon_rights_modifications_for_endpoint.yml @@ -4,7 +4,7 @@ version: 2 date: '2017-09-12' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to retrieve any modifications to logon rights associated with a specific host. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ diff --git a/investigations/get_logon_rights_modifications_for_user.yml b/removed/investigations/get_logon_rights_modifications_for_user.yml similarity index 97% rename from investigations/get_logon_rights_modifications_for_user.yml rename to removed/investigations/get_logon_rights_modifications_for_user.yml index 10d81579af..5ef3f59e75 100644 --- a/investigations/get_logon_rights_modifications_for_user.yml +++ b/removed/investigations/get_logon_rights_modifications_for_user.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-02-27' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to retrieve any modifications to logon rights for a specific user account. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ diff --git a/investigations/get_notable_history.yml b/removed/investigations/get_notable_history.yml similarity index 99% rename from investigations/get_notable_history.yml rename to removed/investigations/get_notable_history.yml index 0263940a86..fdd158e5a3 100644 --- a/investigations/get_notable_history.yml +++ b/removed/investigations/get_notable_history.yml @@ -4,7 +4,7 @@ version: 2 date: '2017-09-20' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. diff --git a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml similarity index 98% rename from investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml rename to removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml index eb30eaa867..3ba36659b0 100644 --- a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-14' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.' diff --git a/investigations/get_parent_process_info.yml b/removed/investigations/get_parent_process_info.yml similarity index 99% rename from investigations/get_parent_process_info.yml rename to removed/investigations/get_parent_process_info.yml index 54a97aea2b..e42faa26af 100644 --- a/investigations/get_parent_process_info.yml +++ b/removed/investigations/get_parent_process_info.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-02-28' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest diff --git a/investigations/get_process_file_activity.yml b/removed/investigations/get_process_file_activity.yml similarity index 98% rename from investigations/get_process_file_activity.yml rename to removed/investigations/get_process_file_activity.yml index 04450db005..88dc720dac 100644 --- a/investigations/get_process_file_activity.yml +++ b/removed/investigations/get_process_file_activity.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-11-06' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search returns the file activity for a specific process on a specific endpoint search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as diff --git a/investigations/get_process_info.yml b/removed/investigations/get_process_info.yml similarity index 99% rename from investigations/get_process_info.yml rename to removed/investigations/get_process_info.yml index c5e6c10d84..8d03f447e0 100644 --- a/investigations/get_process_info.yml +++ b/removed/investigations/get_process_info.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. diff --git a/investigations/get_process_information_for_port_activity.yml b/removed/investigations/get_process_information_for_port_activity.yml similarity index 98% rename from investigations/get_process_information_for_port_activity.yml rename to removed/investigations/get_process_information_for_port_activity.yml index de14541ff3..4b0ae45559 100644 --- a/investigations/get_process_information_for_port_activity.yml +++ b/removed/investigations/get_process_information_for_port_activity.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as diff --git a/investigations/get_process_responsible_for_the_dns_traffic.yml b/removed/investigations/get_process_responsible_for_the_dns_traffic.yml similarity index 98% rename from investigations/get_process_responsible_for_the_dns_traffic.yml rename to removed/investigations/get_process_responsible_for_the_dns_traffic.yml index 09b50690c7..86e2ad11be 100644 --- a/investigations/get_process_responsible_for_the_dns_traffic.yml +++ b/removed/investigations/get_process_responsible_for_the_dns_traffic.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible diff --git a/investigations/get_sysmon_wmi_activity_for_host.yml b/removed/investigations/get_sysmon_wmi_activity_for_host.yml similarity index 97% rename from investigations/get_sysmon_wmi_activity_for_host.yml rename to removed/investigations/get_sysmon_wmi_activity_for_host.yml index e066466664..166013dd2a 100644 --- a/investigations/get_sysmon_wmi_activity_for_host.yml +++ b/removed/investigations/get_sysmon_wmi_activity_for_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-10-23' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search queries Sysmon WMI events for the host of interest. search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' diff --git a/investigations/get_web_session_information_via_session_id.yml b/removed/investigations/get_web_session_information_via_session_id.yml similarity index 97% rename from investigations/get_web_session_information_via_session_id.yml rename to removed/investigations/get_web_session_information_via_session_id.yml index 955b678802..5952077391 100644 --- a/investigations/get_web_session_information_via_session_id.yml +++ b/removed/investigations/get_web_session_information_via_session_id.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-10-08' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP diff --git a/investigations/investigate_aws_activities_via_region_name.yml b/removed/investigations/investigate_aws_activities_via_region_name.yml similarity index 98% rename from investigations/investigate_aws_activities_via_region_name.yml rename to removed/investigations/investigate_aws_activities_via_region_name.yml index d1f8bd0bbb..335daad51e 100644 --- a/investigations/investigate_aws_activities_via_region_name.yml +++ b/removed/investigations/investigate_aws_activities_via_region_name.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user diff --git a/investigations/investigate_aws_user_activities_by_user_field.yml b/removed/investigations/investigate_aws_user_activities_by_user_field.yml similarity index 98% rename from investigations/investigate_aws_user_activities_by_user_field.yml rename to removed/investigations/investigate_aws_user_activities_by_user_field.yml index 84f4231bcd..d0932da712 100644 --- a/investigations/investigate_aws_user_activities_by_user_field.yml +++ b/removed/investigations/investigate_aws_user_activities_by_user_field.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity diff --git a/investigations/investigate_failed_logins_for_multiple_destinations.yml b/removed/investigations/investigate_failed_logins_for_multiple_destinations.yml similarity index 98% rename from investigations/investigate_failed_logins_for_multiple_destinations.yml rename to removed/investigations/investigate_failed_logins_for_multiple_destinations.yml index 929d971fd4..fbd88dcfb6 100644 --- a/investigations/investigate_failed_logins_for_multiple_destinations.yml +++ b/removed/investigations/investigate_failed_logins_for_multiple_destinations.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/removed/investigations/investigate_network_traffic_from_src_ip.yml similarity index 97% rename from investigations/investigate_network_traffic_from_src_ip.yml rename to removed/investigations/investigate_network_traffic_from_src_ip.yml index ba7875b78f..3fc46d2dbe 100644 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ b/removed/investigations/investigate_network_traffic_from_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-15' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to find all the network traffic from a specific IP address. search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' diff --git a/investigations/investigate_okta_activity_by_app.yml b/removed/investigations/investigate_okta_activity_by_app.yml similarity index 97% rename from investigations/investigate_okta_activity_by_app.yml rename to removed/investigations/investigate_okta_activity_by_app.yml index 9c9111a9aa..40a8e95697 100644 --- a/investigations/investigate_okta_activity_by_app.yml +++ b/removed/investigations/investigate_okta_activity_by_app.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events associated with a specific app search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_okta_activity_by_ip_address.yml b/removed/investigations/investigate_okta_activity_by_ip_address.yml similarity index 97% rename from investigations/investigate_okta_activity_by_ip_address.yml rename to removed/investigations/investigate_okta_activity_by_ip_address.yml index a3a945fed5..0f5fbab9f9 100644 --- a/investigations/investigate_okta_activity_by_ip_address.yml +++ b/removed/investigations/investigate_okta_activity_by_ip_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events from a specific IP address. search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_pass_the_hash_attempts.yml b/removed/investigations/investigate_pass_the_hash_attempts.yml similarity index 98% rename from investigations/investigate_pass_the_hash_attempts.yml rename to removed/investigations/investigate_pass_the_hash_attempts.yml index e4a495f05f..5f62609ac9 100644 --- a/investigations/investigate_pass_the_hash_attempts.yml +++ b/removed/investigations/investigate_pass_the_hash_attempts.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search hunts for dumped NTLM hashes used for pass the hash. search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user diff --git a/investigations/investigate_pass_the_ticket_attempts.yml b/removed/investigations/investigate_pass_the_ticket_attempts.yml similarity index 98% rename from investigations/investigate_pass_the_ticket_attempts.yml rename to removed/investigations/investigate_pass_the_ticket_attempts.yml index 3e971419a5..e341b89e92 100644 --- a/investigations/investigate_pass_the_ticket_attempts.yml +++ b/removed/investigations/investigate_pass_the_ticket_attempts.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search hunts for dumped kerberos ticket from LSASS memory. search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) diff --git a/investigations/investigate_previous_unseen_user.yml b/removed/investigations/investigate_previous_unseen_user.yml similarity index 98% rename from investigations/investigate_previous_unseen_user.yml rename to removed/investigations/investigate_previous_unseen_user.yml index 1e70b07b01..9b9e865fc4 100644 --- a/investigations/investigate_previous_unseen_user.yml +++ b/removed/investigations/investigate_previous_unseen_user.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search returns previous unseen user, which didn't log in for 30 days. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login diff --git a/investigations/investigate_successful_remote_desktop_authentications.yml b/removed/investigations/investigate_successful_remote_desktop_authentications.yml similarity index 98% rename from investigations/investigate_successful_remote_desktop_authentications.yml rename to removed/investigations/investigate_successful_remote_desktop_authentications.yml index b5c02044c6..5f4109c67c 100644 --- a/investigations/investigate_successful_remote_desktop_authentications.yml +++ b/removed/investigations/investigate_successful_remote_desktop_authentications.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. diff --git a/investigations/investigate_suspicious_strings_in_http_header.yml b/removed/investigations/investigate_suspicious_strings_in_http_header.yml similarity index 98% rename from investigations/investigate_suspicious_strings_in_http_header.yml rename to removed/investigations/investigate_suspicious_strings_in_http_header.yml index d2d83857e1..6aa7a6cefd 100644 --- a/investigations/investigate_suspicious_strings_in_http_header.yml +++ b/removed/investigations/investigate_suspicious_strings_in_http_header.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-10-20' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by diff --git a/investigations/investigate_user_activities_in_okta.yml b/removed/investigations/investigate_user_activities_in_okta.yml similarity index 97% rename from investigations/investigate_user_activities_in_okta.yml rename to removed/investigations/investigate_user_activities_in_okta.yml index 522e019822..cb133eb7e5 100644 --- a/investigations/investigate_user_activities_in_okta.yml +++ b/removed/investigations/investigate_user_activities_in_okta.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events by a specific user search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_web_posts_from_src.yml b/removed/investigations/investigate_web_posts_from_src.yml similarity index 98% rename from investigations/investigate_web_posts_from_src.yml rename to removed/investigations/investigate_web_posts_from_src.yml index 89d2b23432..0ca5d92202 100644 --- a/investigations/investigate_web_posts_from_src.yml +++ b/removed/investigations/investigate_web_posts_from_src.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation -status: deprecated +status: removed description: This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. diff --git a/stories/deprecated/aws_cryptomining.yml b/removed/stories/aws_cryptomining.yml similarity index 99% rename from stories/deprecated/aws_cryptomining.yml rename to removed/stories/aws_cryptomining.yml index abd30eff4d..67599b5632 100644 --- a/stories/deprecated/aws_cryptomining.yml +++ b/removed/stories/aws_cryptomining.yml @@ -3,7 +3,7 @@ id: ced74200-8465-4bc3-bd2c-9a782eec6750 version: 1 date: '2018-03-08' author: David Dorsey, Splunk -status: deprecated +status: removed description: Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are diff --git a/stories/deprecated/aws_suspicious_provisioning_activities.yml b/removed/stories/aws_suspicious_provisioning_activities.yml similarity index 98% rename from stories/deprecated/aws_suspicious_provisioning_activities.yml rename to removed/stories/aws_suspicious_provisioning_activities.yml index c5403b49fa..d6d7def438 100644 --- a/stories/deprecated/aws_suspicious_provisioning_activities.yml +++ b/removed/stories/aws_suspicious_provisioning_activities.yml @@ -3,7 +3,7 @@ id: 3338b567-3804-4261-9889-cf0ca4753c7f version: 1 date: '2018-03-16' author: David Dorsey, Splunk -status: deprecated +status: removed description: Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. diff --git a/stories/deprecated/common_phishing_frameworks.yml b/removed/stories/common_phishing_frameworks.yml similarity index 99% rename from stories/deprecated/common_phishing_frameworks.yml rename to removed/stories/common_phishing_frameworks.yml index 055ff6b43a..6c8f0279d1 100644 --- a/stories/deprecated/common_phishing_frameworks.yml +++ b/removed/stories/common_phishing_frameworks.yml @@ -3,7 +3,7 @@ id: 9a64ab44-9214-4639-8163-7eaa2621bd61 version: 2 date: '2024-09-24' author: Splunk Research Team, Splunk -status: deprecated +status: removed description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.' diff --git a/stories/deprecated/container_implantation_monitoring_and_investigation.yml b/removed/stories/container_implantation_monitoring_and_investigation.yml similarity index 98% rename from stories/deprecated/container_implantation_monitoring_and_investigation.yml rename to removed/stories/container_implantation_monitoring_and_investigation.yml index 53ee1b98a8..8fc04b5754 100644 --- a/stories/deprecated/container_implantation_monitoring_and_investigation.yml +++ b/removed/stories/container_implantation_monitoring_and_investigation.yml @@ -3,7 +3,7 @@ id: aa0e28b1-0521-4b6f-9d2a-7b87e34af246 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk -status: deprecated +status: removed description: Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container diff --git a/stories/deprecated/host_redirection.yml b/removed/stories/host_redirection.yml similarity index 98% rename from stories/deprecated/host_redirection.yml rename to removed/stories/host_redirection.yml index 90953fb738..8a3c52c671 100644 --- a/stories/deprecated/host_redirection.yml +++ b/removed/stories/host_redirection.yml @@ -3,7 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50fe268af4 version: 1 date: '2017-09-14' author: Rico Valdez, Splunk -status: deprecated +status: removed description: Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches diff --git a/stories/deprecated/kubernetes_sensitive_role_activity.yml b/removed/stories/kubernetes_sensitive_role_activity.yml similarity index 97% rename from stories/deprecated/kubernetes_sensitive_role_activity.yml rename to removed/stories/kubernetes_sensitive_role_activity.yml index 735eb620fa..3e4aea5653 100644 --- a/stories/deprecated/kubernetes_sensitive_role_activity.yml +++ b/removed/stories/kubernetes_sensitive_role_activity.yml @@ -3,7 +3,7 @@ id: 8b3984d2-17b6-47e9-ba43-a3376e70fdcc version: 1 date: '2020-05-20' author: Rod Soto, Splunk -status: deprecated +status: removed description: This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative: Kubernetes is the most used container orchestration platform, this orchestration diff --git a/stories/deprecated/lateral_movement.yml b/removed/stories/lateral_movement.yml similarity index 99% rename from stories/deprecated/lateral_movement.yml rename to removed/stories/lateral_movement.yml index 20c7ee6a69..6fbf027832 100644 --- a/stories/deprecated/lateral_movement.yml +++ b/removed/stories/lateral_movement.yml @@ -3,7 +3,7 @@ id: 399d65dc-1f08-499b-a259-abd9051f38ad version: 3 date: '2024-09-24' author: David Dorsey, Splunk -status: deprecated +status: removed description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." narrative: "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software." references: diff --git a/stories/deprecated/monitor_backup_solution.yml b/removed/stories/monitor_backup_solution.yml similarity index 98% rename from stories/deprecated/monitor_backup_solution.yml rename to removed/stories/monitor_backup_solution.yml index c3f2dc7a32..3b0074346d 100644 --- a/stories/deprecated/monitor_backup_solution.yml +++ b/removed/stories/monitor_backup_solution.yml @@ -3,7 +3,7 @@ id: abe807c7-1eb6-4304-ac32-6e7aacdb891d version: 1 date: '2017-09-12' author: David Dorsey, Splunk -status: deprecated +status: removed description: Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. diff --git a/stories/deprecated/monitor_for_unauthorized_software.yml b/removed/stories/monitor_for_unauthorized_software.yml similarity index 98% rename from stories/deprecated/monitor_for_unauthorized_software.yml rename to removed/stories/monitor_for_unauthorized_software.yml index a9e7d9688d..62b812f61c 100644 --- a/stories/deprecated/monitor_for_unauthorized_software.yml +++ b/removed/stories/monitor_for_unauthorized_software.yml @@ -3,7 +3,7 @@ id: 8892a655-6205-43f7-abba-06460e38c8ae version: 2 date: '2024-09-24' author: David Dorsey, Splunk -status: deprecated +status: removed description: 'Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.' narrative: 'It is critical to identify unauthorized software and processes running diff --git a/stories/deprecated/office_365_detections.yml b/removed/stories/office_365_detections.yml similarity index 98% rename from stories/deprecated/office_365_detections.yml rename to removed/stories/office_365_detections.yml index d2fb3d09b7..00b0764a96 100644 --- a/stories/deprecated/office_365_detections.yml +++ b/removed/stories/office_365_detections.yml @@ -3,7 +3,7 @@ id: 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version: 2 date: '2020-12-16' author: Patrick Bareiss, Mauricio Velazco, Splunk -status: deprecated +status: removed description: Monitor for activities and anomalies indicative of potential threats within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. Given the centralized storage of sensitive organizational data within O365 and its widespread adoption, it has become a focal point for cybersecurity efforts. The platform's complexity, combined with its ubiquity, makes it both a valuable asset and a prime target for potential threats. As O365's importance grows, it increasingly becomes a target for attackers seeking to exploit organizational data and systems. Security teams should prioritize monitoring O365 not just because of the sensitive data it often holds, but also due to the myriad ways the platform can be exploited. Understanding and monitoring O365's security landscape is crucial for organizations to detect, respond to, and mitigate potential threats in a timely manner. references: diff --git a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml b/removed/stories/spectre_and_meltdown_vulnerabilities.yml similarity index 97% rename from stories/deprecated/spectre_and_meltdown_vulnerabilities.yml rename to removed/stories/spectre_and_meltdown_vulnerabilities.yml index 3b0bbf9c8d..baa7d5b14c 100644 --- a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml +++ b/removed/stories/spectre_and_meltdown_vulnerabilities.yml @@ -3,7 +3,7 @@ id: 6d3306f6-bb2b-4219-8609-8efad64032f2 version: 1 date: '2018-01-08' author: David Dorsey, Splunk -status: deprecated +status: removed description: Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. narrative: Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that diff --git a/stories/deprecated/suspicious_aws_ec2_activities.yml b/removed/stories/suspicious_aws_ec2_activities.yml similarity index 98% rename from stories/deprecated/suspicious_aws_ec2_activities.yml rename to removed/stories/suspicious_aws_ec2_activities.yml index 89b5348253..06649b6670 100644 --- a/stories/deprecated/suspicious_aws_ec2_activities.yml +++ b/removed/stories/suspicious_aws_ec2_activities.yml @@ -3,7 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1268af3 version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk -status: deprecated +status: removed description: Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users diff --git a/stories/deprecated/unusual_aws_ec2_modifications.yml b/removed/stories/unusual_aws_ec2_modifications.yml similarity index 98% rename from stories/deprecated/unusual_aws_ec2_modifications.yml rename to removed/stories/unusual_aws_ec2_modifications.yml index f0f1fc4b54..98eb84e135 100644 --- a/stories/deprecated/unusual_aws_ec2_modifications.yml +++ b/removed/stories/unusual_aws_ec2_modifications.yml @@ -3,7 +3,7 @@ id: 73de57ef-0dfc-411f-b1e7-fa24428aeae0 version: 1 date: '2018-04-09' author: David Dorsey, Splunk -status: deprecated +status: removed description: Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. diff --git a/stories/deprecated/web_fraud_detection.yml b/removed/stories/web_fraud_detection.yml similarity index 99% rename from stories/deprecated/web_fraud_detection.yml rename to removed/stories/web_fraud_detection.yml index 81d8ee3448..7e066b1e4c 100644 --- a/stories/deprecated/web_fraud_detection.yml +++ b/removed/stories/web_fraud_detection.yml @@ -3,7 +3,7 @@ id: 18bb45b9-7684-45c6-9e97-1fdd0d98c0a7 version: 1 date: '2018-10-08' author: Jim Apger, Splunk -status: deprecated +status: removed description: Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative: 'The Federal Bureau of Investigations (FBI) defines Internet fraud as the diff --git a/stories/black_basta_ransomware.yml b/stories/black_basta_ransomware.yml new file mode 100644 index 0000000000..d58f9bc49c --- /dev/null +++ b/stories/black_basta_ransomware.yml @@ -0,0 +1,18 @@ +name: Black Basta Ransomware +id: b543afc8-2b65-49d7-8325-a9bca4fd65c8 +version: 1 +date: '2025-02-03' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches for suspicious behaviors associated with Black Basta ransomware, focusing on key indicators such as process execution, registry modifications, and network activity. Monitor for unusual file encryption patterns, particularly involving cmd.exe, powershell.exe, or wmic.exe executing with arguments linked to volume shadow copy deletion (vssadmin delete shadows). Look for registry changes disabling security features or altering startup configurations. Track high-volume file modifications in rapid succession, indicative of ransomware encryption. Additionally, unauthorized remote service executions. Cross-reference endpoint logs, EDR alerts, and SIEM detections to correlate malicious activity. Behavioral analytics and heuristic-based detections can enhance visibility into evolving tactics. Implement robust monitoring and response mechanisms to mitigate Black Basta’s impact effectively. +narrative: Black Basta ransomware is a highly sophisticated and fast-moving threat that has been targeting organizations worldwide, often disrupting critical operations and demanding hefty ransoms. It operates as a double extortion ransomware, encrypting victim data while simultaneously exfiltrating it to pressure victims into paying. The attack typically begins with initial access via phishing emails, compromised credentials, or exploitation of vulnerabilities in remote desktop services. Once inside, attackers escalate privileges, disable security defenses, and deploy the ransomware payload. The malware rapidly encrypts files across local and networked drives, deleting shadow copies to prevent recovery. It often abuses legitimate system tools like wmic.exe and rundll32.exe, to evade detection. Simultaneously, it establishes command-and-control (C2) connections to exfiltrate sensitive data. The impact is severe—disrupting business operations, exposing confidential information, and leaving organizations with few options for recovery. Early detection, network segmentation, and strong endpoint defenses are crucial to mitigating the risk posed by Black Basta. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/deprecated/.gitkeep b/stories/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/stories/systembc.yml b/stories/systembc.yml new file mode 100644 index 0000000000..e25c032ccd --- /dev/null +++ b/stories/systembc.yml @@ -0,0 +1,35 @@ +name: SystemBC +id: ddc2801b-a881-4458-8f9d-c20e95daebea +version: 1 +date: '2025-02-28' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches for Dropped Files anomalies, and registry modification to detect SystemBC malware. + This threat acts as a backdoor proxy that enables attackers to maintain persistence, evade detection, and facilitate ransomware operations. + It often uses SOCKS5 proxies to disguise malicious traffic, making traditional network monitoring less effective. + Look for unusual outbound connections, especially to known threat actor infrastructure. Additionally, analyze PowerShell scripts, + scheduled tasks, and process injections that may indicate SystemBC deployment. Proactive threat hunting and endpoint monitoring are + essential to detecting and mitigating this malware. +narrative: SystemBC is a stealthy malware strain known for its proxy and backdoor capabilities, + often used by cybercriminals to facilitate ransomware attacks. First reported in 2019, it operates as a SOCKS5 proxy, + allowing attackers to route malicious traffic through infected systems while evading detection. + The malware is typically delivered via exploit kits, phishing emails, or secondary payloads from other malware families. + It enables persistent remote access, executes encrypted commands from a C2 server, and helps adversaries maintain control + over compromised networks. SystemBC has been linked to major ransomware operations, making it a significant threat in modern cyberattacks. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc +- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ +- https://hackread.com/systembc-rat-targets-linux-ransomware-infostealers/ +- https://hackread.com/infostealers-breach-us-security-military-fbi-hit/ +- https://www.kroll.com/en/insights/publications/cyber/inside-the-systembc-malware-server +- https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c +- https://securelist.com/focus-on-droxidat-systembc/110302/ +- https://blogs.blackberry.com/en/2021/06/threat-thursday-systembc-a-rat-in-the-pipeline +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file