From 823df51c82288abc1db27d864e09602129ee1b45 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Dec 2022 12:29:53 +0100 Subject: [PATCH 1/7] winpeas_bin --- detections/endpoint/registry_keys_used_for_persistence.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index b5f44b75ae..26a6a1e9d8 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -15,7 +15,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* - OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* + OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" + OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler + OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command + OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" From b352a1418e093c24f0bb29d40198b7f20bbade19 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 4 Jan 2023 13:37:44 +0100 Subject: [PATCH 2/7] add new deployment functionality --- ...e_of_blocked_outbound_traffic_from_aws.yml | 2 - ...loud_infrastructure_api_calls_per_user.yml | 8 ++- .../baseline_of_cloud_instances_destroyed.yml | 8 ++- .../baseline_of_cloud_instances_launched.yml | 8 ++- ...loud_security_group_api_calls_per_user.yml | 8 ++- ...baseline_of_command_line_length___mltk.yml | 3 +- .../baseline_of_dns_query_length___mltk.yml | 2 - ...aseline_of_network_acl_activity_by_arn.yml | 2 - ..._of_s3_bucket_deletion_activity_by_arn.yml | 2 - ...line_of_security_group_activity_by_arn.yml | 2 - baselines/baseline_of_smb_traffic___mltk.yml | 2 - baselines/count_of_assets_by_category.yml | 2 - ...ount_of_unique_ips_connecting_to_ports.yml | 2 - ..._list_of_approved_aws_service_accounts.yml | 2 - ...bited_processes_to_enterprise_security.yml | 2 - .../baseline_of_api_calls_per_user_arn.yml | 2 - ..._aws_instances_launched_by_user___mltk.yml | 2 - ...ws_instances_terminated_by_user___mltk.yml | 2 - ..._api_call_per_user_roles_in_cloudtrail.yml | 2 - ...seen_aws_provisioning_activity_sources.yml | 2 - .../deprecated/previously_seen_ec2_amis.yml | 2 - .../previously_seen_ec2_instance_types.yml | 2 - .../previously_seen_ec2_launches_by_user.yml | 2 - .../previously_seen_users_in_cloudtrail.yml | 2 - ...te_previously_seen_users_in_cloudtrail.yml | 2 - baselines/discover_dns_records.yml | 2 - baselines/dnstwist_domain_names.yml | 2 - ...ystems_creating_remote_desktop_traffic.yml | 2 - ...stems_receiving_remote_desktop_traffic.yml | 2 - .../identify_systems_using_remote_desktop.yml | 2 - baselines/monitor_successful_backups.yml | 2 - baselines/monitor_unsuccessful_backups.yml | 2 - ...iously_seen_aws_cross_account_activity.yml | 2 - ...n_aws_cross_account_activity___initial.yml | 8 ++- ...en_aws_cross_account_activity___update.yml | 2 - baselines/previously_seen_aws_regions.yml | 2 - ...loud_api_calls_per_user_role___initial.yml | 8 ++- ...cloud_api_calls_per_user_role___update.yml | 2 - ...ud_compute_creations_by_user___initial.yml | 8 ++- ...oud_compute_creations_by_user___update.yml | 2 - ...ly_seen_cloud_compute_images___initial.yml | 8 ++- ...sly_seen_cloud_compute_images___update.yml | 2 - ...cloud_compute_instance_types___initial.yml | 8 ++- ..._cloud_compute_instance_types___update.yml | 2 - ...stance_modifications_by_user___initial.yml | 8 ++- ...nstance_modifications_by_user___update.yml | 2 - ...rovisioning_activity_sources___initial.yml | 8 ++- ...provisioning_activity_sources___update.yml | 2 - ...reviously_seen_cloud_regions___initial.yml | 8 ++- ...previously_seen_cloud_regions___update.yml | 2 - ...previously_seen_command_line_arguments.yml | 2 - ...viously_seen_ec2_modifications_by_user.yml | 2 - ...een_running_windows_services___initial.yml | 8 ++- ...seen_running_windows_services___update.yml | 8 ++- ...sly_seen_s3_bucket_access_by_remote_ip.yml | 2 - ...sly_seen_users_in_cloudtrail___initial.yml | 8 ++- ...usly_seen_users_in_cloudtrail___update.yml | 2 - ...ly_seen_zoom_child_processes___initial.yml | 8 ++- ...sly_seen_zoom_child_processes___update.yml | 8 ++- ...ng_interpreter_risky_spl_mltk_baseline.yml | 7 ++- ...ady_for_spectre_meltdown_windows_patch.yml | 2 - .../windows_updates_install_failures.yml | 2 - .../windows_updates_install_successes.yml | 2 - .../domain/entities/deployment.py | 14 ++--- .../domain/entities/detection.py | 2 +- .../domain/entities/detection_tags.py | 2 + .../security_content_baseline_builder.py | 53 ++++++++++--------- .../security_content_detection_builder.py | 41 +++++++------- .../builder/test_data/baseline/baseline.yml | 3 +- deployments/00_default_baseline.yml | 4 +- deployments/11_detect_arp_poisoning.yml | 22 -------- deployments/12_detect_dhcp_poisoning.yml | 23 -------- .../20_baseline_cache_hourly_updates.yml | 13 ----- .../21_baseline_cache_daily_updates.yml | 13 ----- .../30_long_running_baseline_searches.yml | 13 ----- .../31_weeky_model_rebuild_90_days.yml | 13 ----- dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 40 +++++++------- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- 83 files changed, 198 insertions(+), 304 deletions(-) delete mode 100644 deployments/11_detect_arp_poisoning.yml delete mode 100644 deployments/12_detect_dhcp_poisoning.yml delete mode 100644 deployments/20_baseline_cache_hourly_updates.yml delete mode 100644 deployments/21_baseline_cache_daily_updates.yml delete mode 100644 deployments/30_long_running_baseline_searches.yml delete mode 100644 deployments/31_weeky_model_rebuild_90_days.yml diff --git a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml index c8a73d3a63..bb569450bc 100644 --- a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -28,8 +28,6 @@ tags: - AWS Network ACL Activity - Suspicious AWS Traffic - Command and Control - deployments: - - Daily Cache Updates detections: - Detect Spike in blocked Outbound Traffic from your AWS product: diff --git a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml index 6f573ad0f8..00c8592839 100644 --- a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -34,8 +34,6 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities - deployments: - - Weekly Model Rebuild 90 Day Lookback detections: - Abnormally High Number Of Cloud Infrastructure API Calls product: @@ -47,3 +45,9 @@ tags: - All_Changes.user - All_Changes.status security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/baselines/baseline_of_cloud_instances_destroyed.yml index 849525c2bb..998df09902 100644 --- a/baselines/baseline_of_cloud_instances_destroyed.yml +++ b/baselines/baseline_of_cloud_instances_destroyed.yml @@ -37,8 +37,6 @@ tags: analytic_story: - Suspicious Cloud Instance Activities - Cloud Cryptomining - deployments: - - Weekly Model Rebuild 90 Day Lookback detections: - Abnormally High Number Of Cloud Instances Destroyed product: @@ -51,3 +49,9 @@ tags: - All_Changes.status - All_Changes.object_category security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/baselines/baseline_of_cloud_instances_launched.yml index 3e52c6b7ed..811b22f7cf 100644 --- a/baselines/baseline_of_cloud_instances_launched.yml +++ b/baselines/baseline_of_cloud_instances_launched.yml @@ -37,8 +37,6 @@ tags: analytic_story: - Cloud Cryptomining - Suspicious Cloud Instance Activities - deployments: - - Weekly Model Rebuild 90 Day Lookback detections: - Abnormally High Number Of Cloud Instances Launched product: @@ -51,3 +49,9 @@ tags: - All_Changes.status - All_Changes.object_category security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml index 235ec8557c..9f8e1bad53 100644 --- a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -33,8 +33,6 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities - deployments: - - Weekly Model Rebuild 90 Day Lookback detections: - Abnormally High Number Of Cloud Security Group API Calls product: @@ -47,3 +45,9 @@ tags: - All_Changes.status - All_Changes.object_category security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/baseline_of_command_line_length___mltk.yml b/baselines/baseline_of_command_line_length___mltk.yml index be1b32c2ca..ac7c7b3acb 100644 --- a/baselines/baseline_of_command_line_length___mltk.yml +++ b/baselines/baseline_of_command_line_length___mltk.yml @@ -34,8 +34,6 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity - Unusual Processes - deployments: - - Daily Cache Updates detections: - Detect Prohibited Applications Spawning cmd.exe - Unusually Long Command Line - MLTK @@ -50,3 +48,4 @@ tags: - Processes.process_name - Processes.process security_domain: endpoint + diff --git a/baselines/baseline_of_dns_query_length___mltk.yml b/baselines/baseline_of_dns_query_length___mltk.yml index d62c26dd4e..04daab4d50 100644 --- a/baselines/baseline_of_dns_query_length___mltk.yml +++ b/baselines/baseline_of_dns_query_length___mltk.yml @@ -30,8 +30,6 @@ tags: - Hidden Cobra Malware - Suspicious DNS Traffic - Command and Control - deployments: - - Daily Cache Updates detections: - DNS Query Length Outliers - MLTK product: diff --git a/baselines/baseline_of_network_acl_activity_by_arn.yml b/baselines/baseline_of_network_acl_activity_by_arn.yml index 4df783bff3..b3b816c5d4 100644 --- a/baselines/baseline_of_network_acl_activity_by_arn.yml +++ b/baselines/baseline_of_network_acl_activity_by_arn.yml @@ -23,8 +23,6 @@ references: [] tags: analytic_story: - AWS Network ACL Activity - deployments: - - Daily Cache Updates detections: - Detect Spike in Network ACL Activity product: diff --git a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml index e830524f77..a48856dc77 100644 --- a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Suspicious AWS S3 Activities - deployments: - - Daily Cache Updates detections: - Detect Spike in S3 Bucket deletion product: diff --git a/baselines/baseline_of_security_group_activity_by_arn.yml b/baselines/baseline_of_security_group_activity_by_arn.yml index 850a043ea0..43cabcd1cb 100644 --- a/baselines/baseline_of_security_group_activity_by_arn.yml +++ b/baselines/baseline_of_security_group_activity_by_arn.yml @@ -23,8 +23,6 @@ references: [] tags: analytic_story: - AWS User Monitoring - deployments: - - Daily Cache Updates detections: - Detect Spike in Security Group Activity product: diff --git a/baselines/baseline_of_smb_traffic___mltk.yml b/baselines/baseline_of_smb_traffic___mltk.yml index c4849029ba..7ea60c16d6 100644 --- a/baselines/baseline_of_smb_traffic___mltk.yml +++ b/baselines/baseline_of_smb_traffic___mltk.yml @@ -40,8 +40,6 @@ tags: - Hidden Cobra Malware - Netsh Abuse - Ransomware - deployments: - - Daily Cache Updates detections: - Processes launching netsh - SMB Traffic Spike - MLTK diff --git a/baselines/count_of_assets_by_category.yml b/baselines/count_of_assets_by_category.yml index 385aa3bb81..2e3ff8569a 100644 --- a/baselines/count_of_assets_by_category.yml +++ b/baselines/count_of_assets_by_category.yml @@ -19,8 +19,6 @@ references: [] tags: analytic_story: - Asset Tracking - deployments: - - Daily Cache Updates detections: - Detect Unauthorized Assets by MAC address product: diff --git a/baselines/count_of_unique_ips_connecting_to_ports.yml b/baselines/count_of_unique_ips_connecting_to_ports.yml index 2e23bd688e..10283d24ef 100644 --- a/baselines/count_of_unique_ips_connecting_to_ports.yml +++ b/baselines/count_of_unique_ips_connecting_to_ports.yml @@ -20,8 +20,6 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Ransomware - Command and Control - deployments: - - Daily Cache Updates detections: - Prohibited Network Traffic Allowed product: diff --git a/baselines/create_a_list_of_approved_aws_service_accounts.yml b/baselines/create_a_list_of_approved_aws_service_accounts.yml index 3e06e9c5bb..b60bf256a4 100644 --- a/baselines/create_a_list_of_approved_aws_service_accounts.yml +++ b/baselines/create_a_list_of_approved_aws_service_accounts.yml @@ -21,8 +21,6 @@ references: [] tags: analytic_story: - AWS User Monitoring - deployments: - - Daily Cache Updates detections: - Detect AWS API Activities From Unapproved Accounts product: diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml index 2b99cc4fe8..662b49bef6 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -21,8 +21,6 @@ tags: - Monitor for Unauthorized Software - SamSam Ransomware asset_type: Endpoint - deployments: - - Daily Cache Updates detections: - Prohibited Software On Endpoint product: diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml index c27e8beefb..02874c9c4a 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - AWS User Monitoring - deployments: - - Daily Cache Updates detections: - Detect Spike in AWS API Activity product: diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index 0b94c6e35a..0df12d399b 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -33,8 +33,6 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - deployments: - - Daily Cache Updates detections: - Abnormally High AWS Instances Launched by User - MLTK product: diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index bcbcff72a3..4369184ddb 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -33,8 +33,6 @@ references: [] tags: analytic_story: - Suspicious AWS EC2 Activities - deployments: - - Daily Cache Updates detections: - Abnormally High AWS Instances Terminated by User - MLTK product: diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 9568800eab..cfb61398a8 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - AWS User Monitoring - deployments: - - Daily Cache Updates detections: - Detect new API calls from user roles product: diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml index 4e69e66ab7..1b62095d7d 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml @@ -20,8 +20,6 @@ references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities - deployments: - - Daily Cache Updates detections: - AWS Cloud Provisioning From Previously Unseen IP Address - AWS Cloud Provisioning From Previously Unseen City diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/baselines/deprecated/previously_seen_ec2_amis.yml index 859e17dfe2..2d4db54842 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/baselines/deprecated/previously_seen_ec2_amis.yml @@ -18,8 +18,6 @@ references: [] tags: analytic_story: - AWS Cryptomining - deployments: - - Daily Cache Updates detections: - EC2 Instance Started With Previously Unseen AMI product: diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/baselines/deprecated/previously_seen_ec2_instance_types.yml index d7b4b41ac2..07f828a99f 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/baselines/deprecated/previously_seen_ec2_instance_types.yml @@ -18,8 +18,6 @@ references: [] tags: analytic_story: - AWS Cryptomining - deployments: - - Daily Cache Updates detections: - EC2 Instance Started With Previously Unseen Instance Type product: diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml index fc7cde6810..8593df9832 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml @@ -19,8 +19,6 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - deployments: - - Daily Cache Updates detections: - EC2 Instance Started With Previously Unseen User product: diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml index 60681d4489..c10e6be865 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml @@ -23,8 +23,6 @@ references: [] tags: analytic_story: - Suspicious AWS Login Activities - deployments: - - Daily Cache Updates detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml index e9133f2cac..f7672203b6 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml @@ -25,8 +25,6 @@ references: [] tags: analytic_story: - Suspicious AWS Login Activities - deployments: - - Daily Cache Updates detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region diff --git a/baselines/discover_dns_records.yml b/baselines/discover_dns_records.yml index bfc22c151e..ea2d436f9d 100644 --- a/baselines/discover_dns_records.yml +++ b/baselines/discover_dns_records.yml @@ -27,8 +27,6 @@ references: [] tags: analytic_story: - DNS Hijacking - deployments: - - Daily Cache Updates detections: - DNS record changed product: diff --git a/baselines/dnstwist_domain_names.yml b/baselines/dnstwist_domain_names.yml index 95b3b54dbc..56d143e729 100644 --- a/baselines/dnstwist_domain_names.yml +++ b/baselines/dnstwist_domain_names.yml @@ -20,8 +20,6 @@ tags: - Brand Monitoring - Suspicious Emails asset_type: Endpoint - deployments: - - Daily Cache Updates detections: - Monitor Email For Brand Abuse - Monitor DNS For Brand Abuse diff --git a/baselines/identify_systems_creating_remote_desktop_traffic.yml b/baselines/identify_systems_creating_remote_desktop_traffic.yml index ece8d2d0d0..6ed4f0c880 100644 --- a/baselines/identify_systems_creating_remote_desktop_traffic.yml +++ b/baselines/identify_systems_creating_remote_desktop_traffic.yml @@ -21,8 +21,6 @@ tags: - Ryuk Ransomware - Hidden Cobra Malware - Active Directory Lateral Movement - deployments: - - Daily Cache Updates detections: - Remote Desktop Network Traffic product: diff --git a/baselines/identify_systems_receiving_remote_desktop_traffic.yml b/baselines/identify_systems_receiving_remote_desktop_traffic.yml index ad0dafe2b9..82ce7d8312 100644 --- a/baselines/identify_systems_receiving_remote_desktop_traffic.yml +++ b/baselines/identify_systems_receiving_remote_desktop_traffic.yml @@ -22,8 +22,6 @@ tags: - Ryuk Ransomware - Hidden Cobra Malware - Active Directory Lateral Movement - deployments: - - Daily Cache Updates detections: - Remote Desktop Network Traffic product: diff --git a/baselines/identify_systems_using_remote_desktop.yml b/baselines/identify_systems_using_remote_desktop.yml index b4ac09f901..aad6d64306 100644 --- a/baselines/identify_systems_using_remote_desktop.yml +++ b/baselines/identify_systems_using_remote_desktop.yml @@ -21,8 +21,6 @@ tags: - Ryuk Ransomware - Hidden Cobra Malware - Active Directory Lateral Movement - deployments: - - Daily Cache Updates detections: - Remote Desktop Network Traffic product: diff --git a/baselines/monitor_successful_backups.yml b/baselines/monitor_successful_backups.yml index cce8e80196..469a6b3876 100644 --- a/baselines/monitor_successful_backups.yml +++ b/baselines/monitor_successful_backups.yml @@ -18,8 +18,6 @@ references: [] tags: analytic_story: - Monitor Backup Solution - deployments: - - Daily Cache Updates detections: - Unsuccessful Netbackup backups product: diff --git a/baselines/monitor_unsuccessful_backups.yml b/baselines/monitor_unsuccessful_backups.yml index 36287b86fc..08267228d4 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/baselines/monitor_unsuccessful_backups.yml @@ -17,8 +17,6 @@ references: [] tags: analytic_story: - Monitor Backup Solution - deployments: - - Daily Cache Updates detections: - Unsuccessful Netbackup backups product: diff --git a/baselines/previously_seen_aws_cross_account_activity.yml b/baselines/previously_seen_aws_cross_account_activity.yml index 44fcaee040..9cac5a7a27 100644 --- a/baselines/previously_seen_aws_cross_account_activity.yml +++ b/baselines/previously_seen_aws_cross_account_activity.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - AWS Cross Account Activity - deployments: - - Daily Cache Updates detections: - AWS Cross Account Activity From Previously Unseen Account product: diff --git a/baselines/previously_seen_aws_cross_account_activity___initial.yml b/baselines/previously_seen_aws_cross_account_activity___initial.yml index d638bb374d..f615b6c25e 100644 --- a/baselines/previously_seen_aws_cross_account_activity___initial.yml +++ b/baselines/previously_seen_aws_cross_account_activity___initial.yml @@ -26,8 +26,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - deployments: - - 90 Day Baseline detections: - AWS Cross Account Activity From Previously Unseen Account product: @@ -42,3 +40,9 @@ tags: - Authentication.src - Authentication.user_role security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_aws_cross_account_activity___update.yml b/baselines/previously_seen_aws_cross_account_activity___update.yml index 7f39a483ed..dfc483e769 100644 --- a/baselines/previously_seen_aws_cross_account_activity___update.yml +++ b/baselines/previously_seen_aws_cross_account_activity___update.yml @@ -27,8 +27,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - deployments: - - Daily Cache Updates detections: - AWS Cross Account Activity From Previously Unseen Account product: diff --git a/baselines/previously_seen_aws_regions.yml b/baselines/previously_seen_aws_regions.yml index 2259bcab51..39109032a1 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/baselines/previously_seen_aws_regions.yml @@ -20,8 +20,6 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - deployments: - - Daily Cache Updates detections: - EC2 Instance Started In Previously Unseen Region product: diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml index db887a270e..1625cba2d3 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities - deployments: - - 90 Day Baseline detections: - Cloud API Calls From Previously Unseen User Roles product: @@ -37,3 +35,9 @@ tags: - All_Changes.user - All_Changes.command security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml index 5ddbe2e8f4..5171f6a2fe 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml @@ -24,8 +24,6 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities - deployments: - - Daily Cache Updates detections: - Cloud API Calls From Previously Unseen User Roles product: diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml index db0f614cdb..2be9d42b51 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml @@ -19,8 +19,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - Hourly Cache Updates detections: - Cloud Compute Instance Created By Previously Unseen User product: @@ -33,3 +31,9 @@ tags: - All_Changes.object_category - All_Changes.user security_domain: network +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml index 0ed37e5ef6..4896094581 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - Daily Cache Updates detections: - Cloud Compute Instance Created By Previously Unseen User product: diff --git a/baselines/previously_seen_cloud_compute_images___initial.yml b/baselines/previously_seen_cloud_compute_images___initial.yml index 52816b728c..1e8db27323 100644 --- a/baselines/previously_seen_cloud_compute_images___initial.yml +++ b/baselines/previously_seen_cloud_compute_images___initial.yml @@ -21,8 +21,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - 90 Day Baseline detections: - Cloud Compute Instance Created With Previously Unseen Image product: @@ -34,3 +32,9 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.image_id security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_images___update.yml b/baselines/previously_seen_cloud_compute_images___update.yml index a30c726f8a..cefb0afda5 100644 --- a/baselines/previously_seen_cloud_compute_images___update.yml +++ b/baselines/previously_seen_cloud_compute_images___update.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - Daily Cache Updates detections: - Cloud Compute Instance Created With Previously Unseen Image product: diff --git a/baselines/previously_seen_cloud_compute_instance_types___initial.yml b/baselines/previously_seen_cloud_compute_instance_types___initial.yml index 1901b8974a..4dd9476dbd 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___initial.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___initial.yml @@ -20,8 +20,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - 90 Day Baseline detections: - Cloud Compute Instance Created With Previously Unseen Instance Type product: @@ -33,3 +31,9 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.instance_type security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_instance_types___update.yml b/baselines/previously_seen_cloud_compute_instance_types___update.yml index daa987c47f..7a6540e378 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___update.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___update.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - Daily Cache Updates detections: - Cloud Compute Instance Created With Previously Unseen Instance Type product: diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml index b03acd9d3e..48b1d73252 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml @@ -20,8 +20,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Instance Activities - deployments: - - 90 Day Baseline detections: - Cloud Instance Modified By Previously Unseen User product: @@ -35,3 +33,9 @@ tags: - All_Changes.status - All_Changes.user security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml index c95a1e7a7b..b51943b350 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml @@ -24,8 +24,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Instance Activities - deployments: - - Daily Cache Updates detections: - Cloud Instance Modified By Previously Unseen User product: diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml index f103ce58ce..22542e4d13 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml @@ -24,8 +24,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Provisioning Activities - deployments: - - 90 Day Baseline detections: - Cloud Provisioning Activity From Previously Unseen IP Address - Cloud Provisioning Activity From Previously Unseen City @@ -41,3 +39,9 @@ tags: - All_Changes.src - All_Changes.status security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml index ce01a7c493..104740b59d 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml @@ -29,8 +29,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Provisioning Activities - deployments: - - Daily Cache Updates detections: - Cloud Provisioning Activity From Previously Unseen IP Address - Cloud Provisioning Activity From Previously Unseen City diff --git a/baselines/previously_seen_cloud_regions___initial.yml b/baselines/previously_seen_cloud_regions___initial.yml index 1c710097d9..8c83ae3cb2 100644 --- a/baselines/previously_seen_cloud_regions___initial.yml +++ b/baselines/previously_seen_cloud_regions___initial.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - 90 Day Baseline detections: - Cloud Compute Instance Created In Previously Unused Region product: @@ -35,3 +33,9 @@ tags: - All_Changes.action - All_Changes.vendor_region security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_cloud_regions___update.yml b/baselines/previously_seen_cloud_regions___update.yml index f00ff4dc49..d51eeb25b1 100644 --- a/baselines/previously_seen_cloud_regions___update.yml +++ b/baselines/previously_seen_cloud_regions___update.yml @@ -25,8 +25,6 @@ references: [] tags: analytic_story: - Cloud Cryptomining - deployments: - - Daily Cache Updates detections: - Cloud Compute Instance Created In Previously Unused Region product: diff --git a/baselines/previously_seen_command_line_arguments.yml b/baselines/previously_seen_command_line_arguments.yml index f23a273e6c..6f29d709d1 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/baselines/previously_seen_command_line_arguments.yml @@ -30,8 +30,6 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity - IcedID - deployments: - - Daily Cache Updates detections: - First time seen command line argument product: diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/baselines/previously_seen_ec2_modifications_by_user.yml index 12d35bb7e7..86e14cc330 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/baselines/previously_seen_ec2_modifications_by_user.yml @@ -18,8 +18,6 @@ references: [] tags: analytic_story: - Unusual AWS EC2 Modifications - deployments: - - Daily Cache Updates detections: - EC2 Instance Modified With Previously Unseen User product: diff --git a/baselines/previously_seen_running_windows_services___initial.yml b/baselines/previously_seen_running_windows_services___initial.yml index 21c9c2e00b..2a4504f319 100644 --- a/baselines/previously_seen_running_windows_services___initial.yml +++ b/baselines/previously_seen_running_windows_services___initial.yml @@ -20,8 +20,6 @@ tags: - Orangeworm Attack Group - Windows Service Abuse - NOBELIUM Group - deployments: - - 90 Day Baseline detections: - First Time Seen Running Windows Service product: @@ -33,3 +31,9 @@ tags: - EventCode - Message security_domain: endpoint +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_running_windows_services___update.yml b/baselines/previously_seen_running_windows_services___update.yml index 2ba9a0d4f4..c67fa5c292 100644 --- a/baselines/previously_seen_running_windows_services___update.yml +++ b/baselines/previously_seen_running_windows_services___update.yml @@ -25,8 +25,6 @@ tags: - Orangeworm Attack Group - Windows Service Abuse - NOBELIUM Group - deployments: - - Hourly Cache Updates detections: - First Time Seen Running Windows Service product: @@ -38,3 +36,9 @@ tags: - EventCode - Message security_domain: endpoint +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml index 7d6bcad9b4..afff188900 100644 --- a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -21,8 +21,6 @@ references: [] tags: analytic_story: - Suspicious AWS S3 Activities - deployments: - - Daily Cache Updates detections: - Detect S3 access from a new IP product: diff --git a/baselines/previously_seen_users_in_cloudtrail___initial.yml b/baselines/previously_seen_users_in_cloudtrail___initial.yml index 3e428d1d28..8982ce24cb 100644 --- a/baselines/previously_seen_users_in_cloudtrail___initial.yml +++ b/baselines/previously_seen_users_in_cloudtrail___initial.yml @@ -25,8 +25,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - deployments: - - 90 Day Baseline detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region @@ -42,3 +40,9 @@ tags: - Authentication.user - Authentication.src security_domain: network +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_users_in_cloudtrail___update.yml b/baselines/previously_seen_users_in_cloudtrail___update.yml index 406b44379a..60e463be04 100644 --- a/baselines/previously_seen_users_in_cloudtrail___update.yml +++ b/baselines/previously_seen_users_in_cloudtrail___update.yml @@ -25,8 +25,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - deployments: - - Daily Cache Updates detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region diff --git a/baselines/previously_seen_zoom_child_processes___initial.yml b/baselines/previously_seen_zoom_child_processes___initial.yml index a844bf188e..94e2d11d9a 100644 --- a/baselines/previously_seen_zoom_child_processes___initial.yml +++ b/baselines/previously_seen_zoom_child_processes___initial.yml @@ -22,8 +22,6 @@ references: [] tags: analytic_story: - Suspicious Zoom Child Processes - deployments: - - 90 Day Baseline detections: - First Time Seen Child Process of Zoom product: @@ -36,3 +34,9 @@ tags: - Processes.process_name - Processes.dest security_domain: endpoint +deployment: + scheduling: + cron_schedule: 0 2 * * 0 + earliest_time: -90d@d + latest_time: -1d@d + schedule_window: auto \ No newline at end of file diff --git a/baselines/previously_seen_zoom_child_processes___update.yml b/baselines/previously_seen_zoom_child_processes___update.yml index 2f6d459d7b..dc968e2e40 100644 --- a/baselines/previously_seen_zoom_child_processes___update.yml +++ b/baselines/previously_seen_zoom_child_processes___update.yml @@ -27,8 +27,6 @@ references: [] tags: analytic_story: - Suspicious Zoom Child Processes - deployments: - - Hourly Cache Updates detections: - First Time Seen Child Process of Zoom product: @@ -41,3 +39,9 @@ tags: - Processes.process_name - Processes.dest security_domain: endpoint +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto \ No newline at end of file diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index b9275b04d1..47f8f861b7 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -77,4 +77,9 @@ tags: security_domain: audit detections: - Splunk Command and Scripting Interpreter Risky SPL MLTK - +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto diff --git a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml index 933e33e7a3..40628afaf9 100644 --- a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -24,8 +24,6 @@ references: [] tags: analytic_story: - Spectre And Meltdown Vulnerabilities - deployments: - - Daily Cache Updates detections: - Spectre and Meltdown Vulnerable Systems product: diff --git a/baselines/windows_updates_install_failures.yml b/baselines/windows_updates_install_failures.yml index 7404faf256..c74fffda1d 100644 --- a/baselines/windows_updates_install_failures.yml +++ b/baselines/windows_updates_install_failures.yml @@ -17,8 +17,6 @@ references: [] tags: analytic_story: - Monitor for Updates - deployments: - - Daily Cache Updates detections: - No Windows Updates in a time frame product: diff --git a/baselines/windows_updates_install_successes.yml b/baselines/windows_updates_install_successes.yml index 3786be1bc5..ea2bd56702 100644 --- a/baselines/windows_updates_install_successes.yml +++ b/baselines/windows_updates_install_successes.yml @@ -17,8 +17,6 @@ references: [] tags: analytic_story: - Monitor for Updates - deployments: - - Daily Cache Updates detections: - No Windows Updates in a time frame product: diff --git a/bin/contentctl_project/contentctl_core/domain/entities/deployment.py b/bin/contentctl_project/contentctl_core/domain/entities/deployment.py index a3292bfdb1..3fb953a6ab 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/deployment.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/deployment.py @@ -13,19 +13,19 @@ from bin.contentctl_project.contentctl_core.domain.entities.deployment_rba impor from bin.contentctl_project.contentctl_core.domain.entities.deployment_slack import DeploymentSlack from bin.contentctl_project.contentctl_core.domain.entities.deployment_phantom import DeploymentPhantom -class Deployment(BaseModel, SecurityContentObject): - name: str - id: str - date: str - author: str - description: str +class Deployment(BaseModel): + name: str = None + id: str = None + date: str = None + author: str = None + description: str = None scheduling: DeploymentScheduling = None email: DeploymentEmail = None notable: DeploymentNotable = None rba: DeploymentRBA = None slack: DeploymentSlack = None phantom: DeploymentPhantom = None - tags: dict + tags: dict = None @validator('name') diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index f6f22b2b81..69178b50f0 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -20,6 +20,7 @@ from bin.contentctl_project.contentctl_core.domain.entities.lookup import Lookup from bin.contentctl_project.contentctl_core.domain.entities.baseline import Baseline from bin.contentctl_project.contentctl_core.domain.entities.playbook import Playbook from bin.contentctl_project.contentctl_core.domain.entities.link_validator import LinkValidator +from bin.contentctl_project.contentctl_core.domain.entities.deployment import Deployment import sys @@ -43,7 +44,6 @@ class Detection(BaseModel, SecurityContentObject): tags: DetectionTags tests: list[UnitTest] = None - # enrichments datamodel: list = None deprecated: bool = None diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 28338d473e..3b8f8d88c3 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -4,6 +4,7 @@ from pydantic import BaseModel, validator, ValidationError from bin.contentctl_project.contentctl_core.domain.entities.mitre_attack_enrichment import MitreAttackEnrichment from bin.contentctl_project.contentctl_core.domain.constants.constants import * + class DetectionTags(BaseModel): # detection spec name: str @@ -28,6 +29,7 @@ class DetectionTags(BaseModel): cve: list = None supported_tas: list = None + # enrichment mitre_attack_enrichments: list[MitreAttackEnrichment] = [] confidence_id: int = None diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py index 02c2eb7dfe..7e2acc38ab 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py @@ -30,35 +30,38 @@ class SecurityContentBaselineBuilder(BaselineBuilder): sys.exit(1) def addDeployment(self, deployments: list) -> None: - matched_deployments = [] - for d in deployments: - d_tags = dict(d.tags) - baseline_dict = self.baseline.dict() - baseline_tags_dict = self.baseline.tags.dict() - for d_tag in d_tags.keys(): - for attr in baseline_dict.keys(): - if attr == d_tag: - if isinstance(baseline_dict[attr], str): - if baseline_dict[attr] == d_tags[d_tag]: - matched_deployments.append(d) - elif isinstance(baseline_dict[attr], list): - if d_tags[d_tag] in baseline_dict[attr]: - matched_deployments.append(d) + if not self.baseline.deployment: - for attr in baseline_tags_dict.keys(): - if attr == d_tag: - if isinstance(baseline_tags_dict[attr], str): - if baseline_tags_dict[attr] == d_tags[d_tag]: - matched_deployments.append(d) - elif isinstance(baseline_tags_dict[attr], list): - if d_tags[d_tag] in baseline_tags_dict[attr]: - matched_deployments.append(d) + matched_deployments = [] - if len(matched_deployments) == 0: - raise ValueError('No deployment found for baseline: ' + self.baseline.name) + for d in deployments: + d_tags = dict(d.tags) + baseline_dict = self.baseline.dict() + baseline_tags_dict = self.baseline.tags.dict() + for d_tag in d_tags.keys(): + for attr in baseline_dict.keys(): + if attr == d_tag: + if isinstance(baseline_dict[attr], str): + if baseline_dict[attr] == d_tags[d_tag]: + matched_deployments.append(d) + elif isinstance(baseline_dict[attr], list): + if d_tags[d_tag] in baseline_dict[attr]: + matched_deployments.append(d) - self.baseline.deployment = matched_deployments[-1] + for attr in baseline_tags_dict.keys(): + if attr == d_tag: + if isinstance(baseline_tags_dict[attr], str): + if baseline_tags_dict[attr] == d_tags[d_tag]: + matched_deployments.append(d) + elif isinstance(baseline_tags_dict[attr], list): + if d_tags[d_tag] in baseline_tags_dict[attr]: + matched_deployments.append(d) + + if len(matched_deployments) == 0: + raise ValueError('No deployment found for baseline: ' + self.baseline.name) + + self.baseline.deployment = matched_deployments[-1] def reset(self) -> None: diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index a0a6c11558..f8a7679007 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -38,27 +38,30 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def addDeployment(self, deployments: list) -> None: if self.security_content_obj: - matched_deployments = [] - for d in deployments: - d_tags = dict(d.tags) - for d_tag in d_tags.keys(): - for attr in dir(self.security_content_obj): - if not (attr.startswith('__') or attr.startswith('_')): - if attr == d_tag: - if type(self.security_content_obj.__getattribute__(attr)) is str: - attr_values = [self.security_content_obj.__getattribute__(attr)] - else: - attr_values = self.security_content_obj.__getattribute__(attr) - - for attr_value in attr_values: - if attr_value == d_tags[d_tag]: - matched_deployments.append(d) + if not self.security_content_obj.deployment: - if len(matched_deployments) == 0: - self.security_content_obj.deployment = None - else: - self.security_content_obj.deployment = matched_deployments[-1] + matched_deployments = [] + + for d in deployments: + d_tags = dict(d.tags) + for d_tag in d_tags.keys(): + for attr in dir(self.security_content_obj): + if not (attr.startswith('__') or attr.startswith('_')): + if attr == d_tag: + if type(self.security_content_obj.__getattribute__(attr)) is str: + attr_values = [self.security_content_obj.__getattribute__(attr)] + else: + attr_values = self.security_content_obj.__getattribute__(attr) + + for attr_value in attr_values: + if attr_value == d_tags[d_tag]: + matched_deployments.append(d) + + if len(matched_deployments) == 0: + self.security_content_obj.deployment = None + else: + self.security_content_obj.deployment = matched_deployments[-1] def addRBA(self) -> None: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/baseline/baseline.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/baseline/baseline.yml index b8b72bcd76..4b58627f6e 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/baseline/baseline.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/baseline/baseline.yml @@ -25,8 +25,7 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - deployments: - - Daily Cache Updates + detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region diff --git a/deployments/00_default_baseline.yml b/deployments/00_default_baseline.yml index 10bdc8d357..b9d5b21ced 100644 --- a/deployments/00_default_baseline.yml +++ b/deployments/00_default_baseline.yml @@ -4,8 +4,8 @@ date: '2021-12-21' author: Patrick Bareiss description: This configuration file applies to all detections of type baseline. scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m + cron_schedule: 10 0 * * * + earliest_time: -1450m@m latest_time: -10m@m schedule_window: auto tags: diff --git a/deployments/11_detect_arp_poisoning.yml b/deployments/11_detect_arp_poisoning.yml deleted file mode 100644 index c8ab23b4e9..0000000000 --- a/deployments/11_detect_arp_poisoning.yml +++ /dev/null @@ -1,22 +0,0 @@ -name: Detect ARP Poisoning deployment configuration -id: e1d5b4dc-4cf3-404f-905c-b478bbb20474 -date: '2020-08-14' -author: Mikael Bjerkeland -description: This configuration file applies to the Detect ARP Poisoning detection -scheduling: - cron_schedule: 59 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto -alert_action: - notable: - rule_description: ARP Poisoning has been detected on interface $src_interface$ - on host $orig_host$. This may be an indication of a MITM attack. - rule_title: ARP Poisoning Detected on $orig_host$ - nes_fields: - - src_interface - - firstTime - - lastTime - - count -tags: - name: Detect ARP Poisoning diff --git a/deployments/12_detect_dhcp_poisoning.yml b/deployments/12_detect_dhcp_poisoning.yml deleted file mode 100644 index eb52b57951..0000000000 --- a/deployments/12_detect_dhcp_poisoning.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: Detect Rogue DHCP Server deployment configuration -id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb -date: '2020-08-14' -author: Mikael Bjerkeland -description: This configuration file applies to the Detect Rogue DHCP Server detection -scheduling: - cron_schedule: 59 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto -alert_action: - notable: - rule_description: DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ - from $src_mac$. This may be an indication of a MITM attack. - rule_title: Rogue DHCP Server Detected on $orig_host$ - nes_fields: - - src_mac - - firstTime - - lastTime - - count - - message_type -tags: - name: Detect Rogue DHCP Server diff --git a/deployments/20_baseline_cache_hourly_updates.yml b/deployments/20_baseline_cache_hourly_updates.yml deleted file mode 100644 index a29fb96a55..0000000000 --- a/deployments/20_baseline_cache_hourly_updates.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Baseline Cache Hourly Updates -id: 1030c701-2acf-4b1a-9970-46c7145caf2d -date: '2020-06-24' -author: Bhavin Patel -description: This configuration file applies to all baselines with tag deployments - Hourly Cache Updates -scheduling: - cron_schedule: 55 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto -tags: - deployments: Hourly Cache Updates diff --git a/deployments/21_baseline_cache_daily_updates.yml b/deployments/21_baseline_cache_daily_updates.yml deleted file mode 100644 index 66b23dad71..0000000000 --- a/deployments/21_baseline_cache_daily_updates.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Baseline Cache Daily Updates -id: 9541d6f8-fa58-4d48-bb44-6720e39b7b0d -date: '2020-08-18' -author: David Dorsey -description: This configuration file applies to all baselines with tag deployments - Daily Cache Updates -scheduling: - cron_schedule: 10 0 * * * - earliest_time: -1450m@m - latest_time: -10m@m - schedule_window: auto -tags: - deployments: Daily Cache Updates diff --git a/deployments/30_long_running_baseline_searches.yml b/deployments/30_long_running_baseline_searches.yml deleted file mode 100644 index f8d47d43ad..0000000000 --- a/deployments/30_long_running_baseline_searches.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: 90 Day Baseline Searches -id: 6eac9f8b-a35d-4b64-b57f-e5ecde43be6b -date: '2020-06-24' -author: Bhavin Patel -description: This configuration file applies to all baselines with tag deployments - Long Running Baseline -scheduling: - cron_schedule: 0 1 1 1,4,7,10 * - earliest_time: -90d@d - latest_time: -1d@d - schedule_window: auto -tags: - deployments: 90 Day Baseline diff --git a/deployments/31_weeky_model_rebuild_90_days.yml b/deployments/31_weeky_model_rebuild_90_days.yml deleted file mode 100644 index be6eaae38c..0000000000 --- a/deployments/31_weeky_model_rebuild_90_days.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Weekly Model Rebuild 90 Day Lookback -id: 4b329568-bcff-49fa-8c85-92e95f0f270d -date: '2020-09-07' -author: David Dorsey -description: This configuration file applies to all baselines with tag deployments - Weekly Model Rebuild 90 Day Lookback -scheduling: - cron_schedule: 0 2 * * 0 - earliest_time: -90d@d - latest_time: -1d@d - schedule_window: auto -tags: - deployments: Weekly Model Rebuild 90 Day Lookback diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index a7fd782478..4d5113654b 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index b3665eff86..c71da7d9f0 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 9d239b5862..65664940fc 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 6163d52260..135a52a6e0 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 57b4c1c93a..37599f49a1 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -46396,7 +46396,7 @@ action.risk.param._risk_message = tbd action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}] action.risk.param._risk_score = 0 action.risk.param.verbose = 0 -cron_schedule = 59 * * * * +cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 @@ -46404,9 +46404,9 @@ action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Actions On Objectives", "Exploitation"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = src_interface,firstTime,lastTime,count -action.notable.param.rule_description = ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. This may be an indication of a MITM attack. -action.notable.param.rule_title = ARP Poisoning Detected on $orig_host$ +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. +action.notable.param.rule_title = Detect ARP Poisoning action.notable.param.security_domain = network action.notable.param.severity = high alert.digest_mode = 1 @@ -46758,7 +46758,7 @@ action.risk.param._risk_message = tbd action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}] action.risk.param._risk_score = 0 action.risk.param.verbose = 0 -cron_schedule = 59 * * * * +cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 @@ -46766,9 +46766,9 @@ action.correlationsearch.label = ESCU - Detect Rogue DHCP Server - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Actions On Objectives", "Exploitation"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = src_mac,firstTime,lastTime,count,message_type -action.notable.param.rule_description = DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. This may be an indication of a MITM attack. -action.notable.param.rule_title = Rogue DHCP Server Detected on $orig_host$ +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack). +action.notable.param.rule_title = Detect Rogue DHCP Server action.notable.param.security_domain = network action.notable.param.severity = high alert.digest_mode = 1 @@ -49652,7 +49652,7 @@ action.escu.creation_date = 2020-08-15 action.escu.modification_date = 2020-08-15 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.escu.data_models = ["Authentication"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49718,7 +49718,7 @@ action.escu.creation_date = 2020-09-03 action.escu.modification_date = 2020-09-03 action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49806,7 +49806,7 @@ action.escu.creation_date = 2020-10-08 action.escu.modification_date = 2020-10-08 action.escu.analytic_story = ["Cloud Cryptomining"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49850,7 +49850,7 @@ action.escu.creation_date = 2020-9-03 action.escu.modification_date = 2020-9-03 action.escu.analytic_story = ["Cloud Cryptomining"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49894,7 +49894,7 @@ action.escu.creation_date = 2020-07-29 action.escu.modification_date = 2020-07-29 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49938,7 +49938,7 @@ action.escu.creation_date = 2020-08-19 action.escu.modification_date = 2020-08-19 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -49982,7 +49982,7 @@ action.escu.creation_date = 2020-09-02 action.escu.modification_date = 2020-09-02 action.escu.analytic_story = ["Cloud Cryptomining"] action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -50070,7 +50070,7 @@ action.escu.creation_date = 2020-06-23 action.escu.modification_date = 2020-06-23 action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] action.escu.data_models = [] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -50136,7 +50136,7 @@ action.escu.creation_date = 2020-05-28 action.escu.modification_date = 2020-05-28 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.escu.data_models = ["Authentication"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -50180,7 +50180,7 @@ action.escu.creation_date = 2020-05-20 action.escu.modification_date = 2020-05-20 action.escu.analytic_story = ["Suspicious Zoom Child Processes"] action.escu.data_models = ["Endpoint"] -cron_schedule = 0 1 1 1,4,7,10 * +cron_schedule = 0 2 * * 0 enableSched = 1 dispatch.earliest_time = -90d@d dispatch.latest_time = -1d@d @@ -50224,7 +50224,7 @@ action.escu.creation_date = 2022-05-27 action.escu.modification_date = 2022-05-27 action.escu.analytic_story = ["Splunk Vulnerabilities"] action.escu.data_models = ["Splunk_Audit"] -cron_schedule = 0 * * * * +cron_schedule = 55 * * * * enableSched = 1 dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index ccd9b6a52b..4b90ca5dcf 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 6830054909..7339bfe110 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-03T12:38:50 UTC +# On Date: 2023-01-04T11:48:54 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# From ff7005304a4619fd50d2d70ea9c72e124081fbc4 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 4 Jan 2023 14:04:15 +0100 Subject: [PATCH 3/7] Improve rba deployment for hunting searches --- .../templates/savedsearches_detections.j2 | 2 +- dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 1002 +---------------- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- 8 files changed, 8 insertions(+), 1008 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index c984b38532..c6ea5c68a3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -38,7 +38,7 @@ action.escu.providing_technologies = [] {% endif %} {% if detection.tags.analytic_story is defined %} action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} -{% if detection.tags.risk_score is defined and detection.type | lower != "correlation" %} +{% if detection.deployment.rba.enabled is defined %} action.risk = 1 action.risk.param._risk_message = {{ detection.tags.message }} action.risk.param._risk = {{ detection.risk | tojson }} diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 4d5113654b..214ebaeae4 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index c71da7d9f0..b83600fba8 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 65664940fc..0358a33a5a 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 135a52a6e0..7f161560ed 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 37599f49a1..26f0ac4aa4 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -283,11 +283,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious Okta Activity"] -action.risk = 1 -action.risk.param._risk_message = Multple user accounts have failed to authenticate from a single IP. -action.risk.param._risk = [{"risk_object_field": "src_user", "risk_object_type": "user", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -323,11 +318,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Monitor for Updates"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -483,11 +473,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious Okta Activity", "Okta MFA Exhaustion"] -action.risk = 1 -action.risk.param._risk_message = $src_user$ account has rejected multiple Okta pushes. -action.risk.param._risk = [{"risk_object_field": "src_user", "risk_object_type": "user", "risk_score": 18}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -914,11 +899,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Potential exploitation of Code Injection via Dashboard PDF generation. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -994,11 +974,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = A risky Splunk command has ran by $user$ and should be reviewed. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1074,11 +1049,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Potential data exfiltration attack using SID query by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1114,11 +1084,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates -action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1286,11 +1251,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = $peer$ downloaded apps from $host$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 35}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1326,11 +1286,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates -action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1366,11 +1321,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Splunk default issued certificate at $host$ -action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1406,11 +1356,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Failed to validate certificate on $host$ -action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1446,11 +1391,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Possible exploitation attempt from $clientip$ -action.risk.param._risk = [{"risk_object_field": "clientip", "risk_object_type": "system", "risk_score": 81}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1486,11 +1426,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Potential XSS exploitation against radio template by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1526,11 +1461,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = A potential XSS attempt has been detected from $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1658,11 +1588,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = Possible XSS exploitation attempt from $clientip$ -action.risk.param._risk = [{"risk_object_field": "clientip", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -1986,11 +1911,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2026,11 +1946,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2158,11 +2073,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2508,11 +2418,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS Defense Evasion"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ has made potentially risky api calls $eventName$ that could impair AWS security services for account id $aws_account_id$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2548,11 +2453,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS Defense Evasion"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ has created a new rule to on an S3 bucket $bucket_name$ with short expiration days -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 20}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 20}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2680,11 +2580,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["AWS Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2720,11 +2615,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["AWS Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2760,11 +2650,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["AWS Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2800,11 +2685,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -2840,11 +2720,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["AWS Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -3012,11 +2887,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["Dev Sec Ops"] -action.risk = 1 -action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 7}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -3304,11 +3174,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -3384,11 +3249,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ -action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -3424,11 +3284,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.risk = 1 -action.risk.param._risk_message = User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -5466,11 +5321,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious Cloud Authentication Activities", "AWS Identity and Access Management Account Takeover"] -action.risk = 1 -action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -5506,11 +5356,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities", "AWS Identity and Access Management Account Takeover"] -action.risk = 1 -action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -5546,11 +5391,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities", "AWS Identity and Access Management Account Takeover"] -action.risk = 1 -action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -5586,11 +5426,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities", "AWS Identity and Access Management Account Takeover"] -action.risk = 1 -action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -6142,11 +5977,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -6400,11 +6230,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Spearphishing Attachments", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -6840,11 +6665,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Spearphishing Attachments"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -6960,11 +6780,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -7944,11 +7759,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -8078,11 +7888,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS User Monitoring"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -8124,11 +7929,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["AWS User Monitoring"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -8346,11 +8146,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["Suspicious AWS Login Activities"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -8753,11 +8548,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group", "CISA AA22-257A"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9039,11 +8829,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Monitor Backup Solution"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9079,11 +8864,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9119,11 +8899,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["GCP Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9159,11 +8934,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["GCP Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9199,11 +8969,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["GCP Cross Account Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9285,11 +9050,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Account Monitoring and Controls"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9325,11 +9085,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9365,11 +9120,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9405,11 +9155,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9445,11 +9190,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9485,11 +9225,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9525,11 +9260,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9565,11 +9295,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9605,11 +9330,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9645,11 +9365,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9685,11 +9400,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9725,11 +9435,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9765,11 +9470,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9805,11 +9505,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9845,11 +9540,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9885,11 +9575,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9925,11 +9610,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -9965,11 +9645,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10005,11 +9680,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10229,11 +9899,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Monitor for Unauthorized Software", "Emotet Malware DHS Report TA18-201A ", "SamSam Ransomware"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10585,11 +10250,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Hidden Cobra Malware"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10671,11 +10331,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"] -action.risk = 1 -action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10711,11 +10366,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Collection and Staging"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10751,11 +10401,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes", "Hermetic Wiper"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -10837,11 +10482,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Monitor Backup Solution"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -11095,11 +10735,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_message = archive process $process_name$ with suspicious cmdline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -12779,11 +12414,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT", "ProxyNotShell", "Qakbot"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -13006,11 +12636,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}, {"threat_object_field": "file_count", "threat_object_type": "other"}, {"threat_object_field": "path_count", "threat_object_type": "other"}, {"threat_object_field": "file_extension", "threat_object_type": "other"}, {"threat_object_field": "Name", "threat_object_type": "other"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -13046,11 +12671,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -13592,11 +13212,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_message = csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -14092,11 +13707,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Detect Zerologon Attack"] -action.risk = 1 -action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -14412,11 +14022,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -14734,11 +14339,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -15004,11 +14604,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -15501,11 +15096,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Collection and Staging"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -15541,11 +15131,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Active Directory Lateral Movement", "CISA AA22-320A"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -15581,11 +15166,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -15621,11 +15201,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Collection and Staging", "CISA AA22-277A"] -action.risk = 1 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17556,11 +17131,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17734,11 +17304,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Domain controller discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17820,11 +17385,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17860,11 +17420,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17900,11 +17455,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -17986,11 +17536,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["IcedID"] -action.risk = 1 -action.risk.param._risk_message = process $SourceImage$ create a file $TargetImage$ in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -18228,11 +17773,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Elevated group discovery using PowerView on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -18452,11 +17992,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Credential Dumping", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -19732,11 +19267,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -19772,11 +19302,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = powershell process having commandline $Message$ to query domain password policy -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -19812,11 +19337,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -19852,11 +19372,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20364,11 +19879,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System group discovery on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20408,11 +19918,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System group discovery enumeration on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20448,11 +19953,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20488,11 +19988,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery", "CISA AA22-320A"] -action.risk = 1 -action.risk.param._risk_message = Remote system discovery enumeration on $Computer$ by $UserID$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20528,11 +20023,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20568,11 +20058,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20608,11 +20093,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20648,11 +20128,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20780,11 +20255,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Remote system discovery using PowerView on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20958,11 +20428,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -20998,11 +20463,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery", "Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $Computer$ by $user$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -21038,11 +20498,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -21078,11 +20533,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $Computer$ by $user$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -21394,11 +20844,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -21434,11 +20879,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery", "Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $Computer$ by $UserID$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -21784,11 +21224,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["IcedID"] -action.risk = 1 -action.risk.param._risk_message = process $SourceImage$ create a file $TargetImage$ in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -22450,11 +21885,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_message = A commandline $process$ that may create user account on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -22490,11 +21920,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Industroyer2", "Linux Privilege Escalation", "Linux Persistence Techniques", "Linux Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = A possible crontab list command $process$ executed on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -22930,11 +22355,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques", "Linux Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = A commandline $process$ with process $process_name$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -23612,11 +23032,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques", "Linux Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = A possible crontab edit command $process$ executed on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -24058,11 +23473,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Living Off The Land", "Ingress Tool Transfer"] -action.risk = 1 -action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing curl or wget. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 1}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 1}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -24344,11 +23754,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["CyclopsBLink"] -action.risk = 1 -action.risk.param._risk_message = a $process_name$ with kworker commandline in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -24991,11 +24396,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques", "Linux Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = A commandline $process$ that may modify cronjob file in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -25031,11 +24431,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques", "Linux Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = A commandline $process$ that may modify cronjob file using editor in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -25781,11 +25176,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_message = A commandline $process$ that execute sudo or su in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -26028,11 +25418,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -26068,11 +25453,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local user discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -26477,11 +25857,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "NOBELIUM Group", "WhisperGate", "DarkCrystal RAT", "Qakbot", "CISA AA22-320A"] -action.risk = 1 -action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27107,11 +26482,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"] -action.risk = 1 -action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. -action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27423,11 +26793,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Windows Discovery Techniques", "Azorult", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Local group discovery on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27509,11 +26874,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Qakbot", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27549,11 +26909,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Azorult", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27589,11 +26944,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Qakbot", "CISA AA22-277A", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -27629,11 +26979,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Qakbot", "CISA AA22-277A", "Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -28675,11 +28020,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -28902,11 +28242,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Remcos"] -action.risk = 1 -action.risk.param._risk_message = suspicious process $process_name$ contains commandline $process$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 16}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 16}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -28988,11 +28323,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Credential Dumping", "Insider Threat"] -action.risk = 1 -action.risk.param._risk_message = Potential password in username ($user$) with Shannon entropy ($ut_shannon$) -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 21}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 21}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -29068,11 +28398,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $user$ executing suspicious commands. -action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -29108,11 +28433,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228", "AgentTesla"] -action.risk = 1 -action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"threat_object_field": "process", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -29540,11 +28860,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local group discovery on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -29584,11 +28899,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local group discovery on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -30387,11 +29697,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Remcos"] -action.risk = 1 -action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -30513,11 +29818,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Lateral Movement", "CISA AA22-257A"] -action.risk = 1 -action.risk.param._risk_message = A windows scheduled task with a suspicious task name was created on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -30553,11 +29853,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Active Directory Lateral Movement"] -action.risk = 1 -action.risk.param._risk_message = A Windows Service with a suspicious service name was installed on $ComputerName$ -action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 45}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -31121,11 +30416,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Hidden Cobra Malware", "Active Directory Lateral Movement"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -31575,11 +30865,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -31615,11 +30900,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -31977,11 +31257,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"] -action.risk = 1 -action.risk.param._risk_message = elevated process using runas on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -32017,11 +31292,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -32557,11 +31827,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_message = The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}, {"threat_object_field": "Object_Name", "threat_object_type": "file"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -34875,11 +34140,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -35007,11 +34267,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -35853,11 +35108,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"] -action.risk = 1 -action.risk.param._risk_message = A suspicious TGT was requested was requested -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36077,11 +35327,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Remcos"] -action.risk = 1 -action.risk.param._risk_message = dxdiag.exe process with commandline $process$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36207,11 +35452,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36247,11 +35487,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery", "Qakbot"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36663,11 +35898,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks"] -action.risk = 1 -action.risk.param._risk_message = -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36747,11 +35977,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Lateral Movement"] -action.risk = 1 -action.risk.param._risk_message = -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36867,11 +36092,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -36907,11 +36127,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Microsoft Windows"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = System user discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -37039,11 +36254,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Unusual Processes"] -action.risk = 1 -action.risk.param._risk_message = process $process_name$ to execute possible clsid commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -37441,11 +36651,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Brute Ratel C4"] -action.risk = 1 -action.risk.param._risk_message = A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 36}, {"threat_object_field": "SourceImage", "threat_object_type": "process name"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -37997,11 +37202,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"] -action.risk = 1 -action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39047,11 +38247,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39179,11 +38374,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Living Off The Land", "Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 1}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 1}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39219,11 +38409,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Living Off The Land", "Windows Defense Evasion Tactics", "Qakbot"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ loading $process_name$ was identified on endpoint $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 1}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39489,11 +38674,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Windows Drivers", "CISA AA22-320A", "AgentTesla"] -action.risk = 1 -action.risk.param._risk_message = A driver has loaded on $Computer$. -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39529,11 +38709,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_message = Service was disabled on $Computer$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 36}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39615,11 +38790,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_message = Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39873,11 +39043,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Brute Ratel C4"] -action.risk = 1 -action.risk.param._risk_message = An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information. -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -39913,11 +39078,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Azorult", "DarkCrystal RAT"] -action.risk = 1 -action.risk.param._risk_message = process connecting IP location web services on $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40165,11 +39325,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_message = A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40205,11 +39360,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40245,11 +39395,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Azorult"] -action.risk = 1 -action.risk.param._risk_message = Applocker importing xml policy command was executed in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40285,11 +39430,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"] -action.risk = 1 -action.risk.param._risk_message = Windows Defender context menu registry key deleted on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40583,11 +39723,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = process $process_name$ with commandline $process$ is executed in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -40663,11 +39798,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Brute Ratel C4"] -action.risk = 1 -action.risk.param._risk_message = a process $Image$ loaded $ImageLoaded$ in $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -41076,11 +40206,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Spearphishing Attachments", "Brute Ratel C4", "AgentTesla", "Qakbot", "IcedID", "Azorult", "Remcos"] -action.risk = 1 -action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -41678,11 +40803,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = execution of process $process_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -42332,11 +41452,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["WhisperGate"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -42418,11 +41533,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Living Off The Land"] -action.risk = 1 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -42596,11 +41706,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = a process with commandline $process$ that can retrieve information related to password manager databases in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -42636,11 +41741,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Brute Ratel C4", "AgentTesla", "Qakbot", "IcedID", "Azorult", "Remcos"] -action.risk = 1 -action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -43136,11 +42236,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Brute Ratel C4"] -action.risk = 1 -action.risk.param._risk_message = process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -43302,11 +42397,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = execution of process $process_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -43744,11 +42834,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Insider Threat", "Command and Control", "Ransomware"] -action.risk = 1 -action.risk.param._risk_message = The following Remote Access Software $process_name$ was identified on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 1}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44622,11 +43707,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = process klist.exe executed in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44708,11 +43788,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Qakbot"] -action.risk = 1 -action.risk.param._risk_message = System nslookup domain discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44748,11 +43823,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Qakbot"] -action.risk = 1 -action.risk.param._risk_message = System qwinsta domain discovery on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44788,11 +43858,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Drivers", "CISA AA22-264A"] -action.risk = 1 -action.risk.param._risk_message = A new driver is present on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 10}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44868,11 +43933,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = process $process_name$ with commandline $process$ is executed in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -44908,11 +43968,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = netsh process with command line $process$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -45114,11 +44169,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Windows Post-Exploitation", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = execution of process $process_name$ in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -45366,11 +44416,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Suspicious WMI Use", "Qakbot"] -action.risk = 1 -action.risk.param._risk_message = process with $process$ commandline executed in $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -45522,11 +44567,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2", "DarkCrystal RAT", "CISA AA22-257A", "Qakbot", "Prestige Ransomware"] -action.risk = 1 -action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -45989,11 +45029,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Active Directory Discovery"] -action.risk = 1 -action.risk.param._risk_message = Local group discovery on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -46029,11 +45064,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["IcedID", "Azorult"] -action.risk = 1 -action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -46621,11 +45651,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Log4Shell CVE-2021-44228"] -action.risk = 1 -action.risk.param._risk_message = An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "dest_ip", "risk_object_type": "system", "risk_score": 56}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -47806,11 +46831,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Splunk Vulnerabilities"] -action.risk = 1 -action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -47846,11 +46866,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["OpenSSL CVE-2022-3602"] -action.risk = 1 -action.risk.param._risk_message = A x509 certificate has been identified to have punycode in the SSL issuer email domain on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -47972,11 +46987,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["OpenSSL CVE-2022-3602"] -action.risk = 1 -action.risk.param._risk_message = A x509 certificate has been identified to have punycode in the subject alternative name on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -48314,11 +47324,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["Log4Shell CVE-2021-44228", "CISA AA22-320A"] -action.risk = 1 -action.risk.param._risk_message = Hunting for Log4Shell exploitation has occurred. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "http_method", "threat_object_type": "other"}, {"threat_object_field": "src", "threat_object_type": "other"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m @@ -48659,11 +47664,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = null action.escu.analytic_story = ["VMware Server Side Injection and Privilege Escalation"] -action.risk = 1 -action.risk.param._risk_message = An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 4b90ca5dcf..5ff7f1fe2e 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 7339bfe110..6817c751d1 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T11:48:54 UTC +# On Date: 2023-01-04T12:58:29 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# From 00976fe839aa332645cae7f862f8e3c3edbe6771 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 9 Jan 2023 09:20:37 +0100 Subject: [PATCH 4/7] bug fix in converter script --- ...mber_of_failed_authentications_from_ip.yml | 7 -- ...dential_dump_from_registry_via_reg_exe.yml | 5 - detections/endpoint/bits_job_persistence.yml | 11 -- .../endpoint/bitsadmin_download_file.yml | 11 -- .../endpoint/creation_of_shadow_copy.yml | 11 -- .../download_files_using_telegram.yml | 5 +- .../endpoint/drop_icedid_license_dat.yml | 5 +- .../endpoint/dump_lsass_via_procdump.yml | 11 -- detections/endpoint/hunting_for_log4shell.yml | 111 ++++++++++++++++++ ...did_exfiltrated_archived_file_creation.yml | 5 +- .../endpoint/modification_of_wallpaper.yml | 5 +- ..._scripting_process_loading_ldap_module.yml | 5 +- ...s_scripting_process_loading_wmi_module.yml | 5 +- ...entially_malicious_code_on_commandline.yml | 7 +- ...remote_thread_to_known_windows_process.yml | 5 +- .../wbadmin_delete_system_backups.yml | 5 +- ...ss_connecting_to_ip_check_web_services.yml | 5 +- ..._hijacking_inprocserver32_modification.yml | 6 +- ...dows_curl_upload_to_remote_destination.yml | 5 +- .../windows_disable_memory_crash_dump.yml | 6 - .../windows_diskshadow_proxy_execution.yml | 5 +- ...ows_dotnet_binary_in_non_standard_path.yml | 5 +- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- ..._indirect_command_execution_via_pcalua.yml | 6 - ...s_ingress_tool_transfer_using_explorer.yml | 6 +- .../windows_odbcconf_load_response_file.yml | 6 +- .../windows_rasautou_dll_execution.yml | 5 +- ...execution_compiled_html_file_decompile.yml | 5 +- 28 files changed, 160 insertions(+), 120 deletions(-) create mode 100644 detections/endpoint/hunting_for_log4shell.yml diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 86485b1f67..19ae204b39 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -69,10 +69,3 @@ tags: - Splunk Cloud risk_score: 54 security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log - source: mscs:azure:eventhub - sourcetype: mscs:azure:eventhub - update_timestamp: true diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index ddcb45b7c5..2ffe4bbbc6 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -65,8 +65,3 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index e3a51d914d..0d4706144f 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -70,14 +70,3 @@ tags: - Splunk Cloud risk_score: 56 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 59453ea0a2..bcf799d2ba 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -76,14 +76,3 @@ tags: - Splunk Cloud risk_score: 49 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index c9dc003a66..5d1456aca9 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -61,14 +61,3 @@ tags: - Splunk Cloud risk_score: 81 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 966dd419ce..392c485fd3 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -10,9 +10,8 @@ description: The following analytic will identify a suspicious download by the T the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. -data_source: -- Sysmon Event ID 1 -search: '`sysmon` EventCode=15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" +data_source: [] +search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index a705e741fa..d1d2bf66fa 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -8,9 +8,8 @@ type: Hunting description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. -data_source: -- Sysmon Event ID 1 -search: '`sysmon` EventCode=11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" +data_source: [] +search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index f8c63cb59a..95ba5e784f 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -71,14 +71,3 @@ tags: - Splunk Cloud risk_score: 80 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml new file mode 100644 index 0000000000..1b75603edc --- /dev/null +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -0,0 +1,111 @@ +name: Hunting for Log4Shell +id: 158b68fa-5d1a-11ec-aac8-acde48001122 +version: 1 +date: '2021-12-14' +author: Michael Haag, Splunk +status: production +type: Hunting +description: 'The following hunting query assists with quickly assessing CVE-2021-44228, + or Log4Shell, activity mapped to the Web Datamodel. This is a combination query + attempting to identify, score and dashboard. Because the Log4Shell vulnerability + requires the string to be in the logs, this will work to identify the activity anywhere + in the HTTP headers using _raw. Modify the first line to use the same pattern matching + against other log sources. Scoring is based on a simple rubric of 0-5. 5 being the + best match, and less than 5 meant to identify additional patterns that will equate + to a higher total score. \ + + The first jndi match identifies the standard pattern of `{jndi:` \ + + jndi_fastmatch is meant to identify any jndi in the logs. The score is set low and + is meant to be the "base" score used later. \ + + jndi_proto is a protocol match that identifies `jndi` and one of `ldap, ldaps, rmi, + dns, nis, iiop, corba, nds, http, https.` \ + + all_match is a very well written regex by https://gist.github.com/Schvenn that identifies + nearly all patterns of this attack behavior. \ + + env works to identify environment variables in the header, meant to capture `AWS_ACCESS_KEY_ID`, + `AWS_SECRET_ACCESS_KEY` and `env`. \ + + uri_detect is string match looking for the common uri paths currently being scanned/abused + in the wild. \ + + keywords matches on enumerated values that, like `$ctx:loginId`, that may be found + in the header used by the adversary. \ + + lookup matching is meant to catch some basic obfuscation that has been identified + using upper, lower and date. \ + + Scoring will then occur based on any findings. The base score is meant to be 2 , + created by jndi_fastmatch. Everything else is meant to increase that score. \ + + Finally, a simple table is created to show the scoring and the _raw field. Sort + based on score or columns of interest.' +data_source: [] +search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) + | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) + | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) + | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") + OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, + "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) + | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) + | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ + /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, + "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0) | addtotals fieldname=Score, + jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, + lookups | where Score > 2 | stats values(Score) by jndi, jndi_proto, env_var, uridetect, + all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`' +how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. + However, tested was performed against raw httpd access logs. Change the first line + to any dataset to pass the regex's against. +known_false_positives: It is highly possible you will find false positives, however, + the base score is set to 2 for _any_ jndi found in raw logs. tune and change as + needed, include any filtering. +references: +- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 +- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449 +- https://regex101.com/r/OSrm0q/1/ +- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar +- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/ +- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c +- https://twitter.com/sasi2103/status/1469764719850442760?s=20 +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + - CISA AA22-320A + asset_type: Web Server + atomic_guid: [] + confidence: 50 + cve: + - CVE-2021-44228 + drilldown_search: [] + impact: 80 + message: Hunting for Log4Shell exploitation has occurred. + mitre_attack_id: + - T1190 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: http_method + type: Other + role: + - Other + - name: src + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 40 + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/log4shell-nginx.log + source: /var/log/nginx/access.log + sourcetype: nginx:plus:kv diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 9f08001a03..7c71f62ab4 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -8,9 +8,8 @@ type: Hunting description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. -data_source: -- Sysmon Event ID 1 -search: '`sysmon` EventCode=11 (TargetFilename = "*\\passff.tar" OR TargetFilename +data_source: [] +search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index b3f5b6b0d0..35826784bb 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -9,9 +9,8 @@ description: This analytic identifies suspicious modification of registry to def or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. -data_source: -- Sysmon Event ID 1 -search: '`sysmon` EventCode=13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" +data_source: [] +search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 7aa2ff4d48..9d07a3ae6e 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -12,9 +12,8 @@ description: This search is to detect a suspicious MS scripting process such as step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. -data_source: -- Sysmon Event ID 7 -search: '`sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded +data_source: [] +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 9dc1818790..7dd7c5ef2e 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -12,9 +12,8 @@ description: This search is to detect a suspicious MS scripting process such as to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. -data_source: -- Sysmon Event ID 7 -search: '`sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded +data_source: [] +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index e87788ea9e..fcfb282c1f 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -15,11 +15,10 @@ description: The following analytic uses a pretrained machine learning text clas script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline. The model will output a score where all values above zero are suspicious, anything greater than one particularly so. -data_source: -- Sysmon Event ID 1 +data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name - Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | + as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name + Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 6d06f19a55..f46268ed91 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -10,9 +10,8 @@ description: this search is designed to detect suspicious powershell process tha CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload -data_source: -- Sysmon Event ID 8 -search: '`sysmon` EventCode=8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") +data_source: [] +search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 2138d29ea6..3c72409f6d 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -52,5 +52,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log - source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 50f47aae6e..31f052190b 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -12,9 +12,8 @@ description: this search is designed to detect suspicious wermgr.exe process tha for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. -data_source: -- Sysmon Event ID 22 -search: '`sysmon` EventCode=22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", +data_source: [] +search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 2368d5e338..0257cca01e 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -70,7 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index b3a7c4d019..194593828a 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -80,5 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log - source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 27fac7d7f9..b433453584 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -72,9 +72,3 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index 3e46e5e91f..3b8544ebf4 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -54,5 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log - source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index df9d190ba4..7e82d4cd3c 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -81,5 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log - source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index a4ae65919a..5a1bf5deb8 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -74,7 +74,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index c65f721100..a8f941f979 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -48,9 +48,3 @@ tags: - Splunk Cloud risk_score: 25 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index 1b6dd904f7..d27040da33 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -70,7 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 7ebe83e049..01473589bf 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -66,7 +66,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 7a1da542ee..e4e5168a25 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -65,5 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log - source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 98a018aae0..4ab2e0351d 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -65,6 +65,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log - source: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true From fd0c8b349f2b8431ebbb64263a81058929fe6f30 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 9 Jan 2023 09:33:30 +0100 Subject: [PATCH 5/7] updated tags --- .../detect_new_login_attempts_to_routers.yml | 2 - ...ct_risky_spl_using_pretrained_ml_model.yml | 2 - .../email_attachments_with_lots_of_spaces.yml | 2 - ...itten_outside_of_the_outlook_directory.yml | 2 - ...s_sending_high_volume_traffic_to_hosts.yml | 2 - .../monitor_email_for_brand_abuse.yml | 2 - ...h_invalid_credentials_from_the_same_ip.yml | 2 - .../no_windows_updates_in_a_time_frame.yml | 2 - .../application/okta_account_locked_out.yml | 2 - .../okta_account_lockout_events.yml | 2 - .../application/okta_failed_sso_attempts.yml | 2 - .../application/okta_mfa_exhaustion_hunt.yml | 2 - .../okta_new_api_token_created.yml | 2 - .../okta_new_device_enrolled_on_account.yml | 2 - .../okta_risk_threshold_exceeded.yml | 2 - .../okta_suspicious_activity_reported.yml | 2 - .../okta_threatinsight_threat_detected.yml | 2 - .../okta_two_or_more_rejected_okta_pushes.yml | 2 - .../okta_user_logins_from_multiple_cities.yml | 2 - .../path_traversal_spl_injection.yml | 2 - ...scovery_drilldown_dashboard_disclosure.yml | 2 - ...on_via_custom_dashboard_leading_to_rce.yml | 2 - ...and_scripting_interpreter_delete_usage.yml | 2 - ...d_scripting_interpreter_risky_commands.yml | 2 - ...d_scripting_interpreter_risky_spl_mltk.yml | 2 - ...om_analytics_workspace_using_sid_query.yml | 2 - ...al_certificates_infrastructure_version.yml | 2 - ...igital_certificates_lack_of_encryption.yml | 2 - .../splunk_dos_via_malformed_s2s_request.yml | 2 - ...ndpoint_denial_of_service_dos_zip_bomb.yml | 2 - ...s_injection_forwarder_bundle_downloads.yml | 2 - ...sonation_weak_encryption_configuration.yml | 2 - ...personation_weak_encryption_selfsigned.yml | 2 - ...sonation_weak_encryption_simplerequest.yml | 2 - ..._gateway__splunk_mobile_alerts_feature.yml | 2 - ...ected_xss_in_the_templates_lists_radio.yml | 2 - ...ed_xss_via_data_model_objectname_field.yml | 2 - .../splunk_user_enumeration_attempt.yml | 2 - .../splunk_xss_in_monitoring_console.yml | 2 - ...ave_table_dialog_header_in_search_page.yml | 2 - ...suspicious_email_attachment_extensions.yml | 2 - .../application/suspicious_java_classes.yml | 2 - ...servers_executing_suspicious_processes.yml | 2 - ...mber_of_cloud_infrastructure_api_calls.yml | 2 - ...gh_number_of_cloud_instances_destroyed.yml | 2 - ...igh_number_of_cloud_instances_launched.yml | 2 - ...mber_of_cloud_security_group_api_calls.yml | 2 - ..._eks_kubernetes_cluster_scan_detection.yml | 2 - ...azon_eks_kubernetes_pod_scan_detection.yml | 2 - ...sole_login_failed_during_mfa_challenge.yml | 2 - ..._policy_version_to_allow_all_resources.yml | 2 - detections/cloud/aws_createaccesskey.yml | 2 - detections/cloud/aws_createloginprofile.yml | 2 - .../aws_credential_access_failed_login.yml | 2 - .../aws_credential_access_getpassworddata.yml | 2 - ...s_credential_access_rds_password_reset.yml | 2 - ...ctivity_from_previously_unseen_account.yml | 2 - .../aws_defense_evasion_delete_cloudtrail.yml | 2 - ...se_evasion_delete_cloudwatch_log_group.yml | 2 - ...fense_evasion_impair_security_services.yml | 2 - ...aws_defense_evasion_putbucketlifecycle.yml | 2 - ...efense_evasion_stop_logging_cloudtrail.yml | 2 - .../aws_defense_evasion_update_cloudtrail.yml | 2 - .../aws_detect_attach_to_role_policy.yml | 2 - .../aws_detect_permanent_key_creation.yml | 2 - detections/cloud/aws_detect_role_creation.yml | 2 - .../aws_detect_sts_assume_role_abuse.yml | 2 - ...aws_detect_sts_get_session_token_abuse.yml | 2 - ...g_keys_with_encrypt_policy_without_mfa.yml | 2 - ...with_kms_keys_performing_encryption_s3.yml | 2 - ...s_ecr_container_scanning_findings_high.yml | 2 - ...ing_findings_low_informational_unknown.yml | 2 - ...ecr_container_scanning_findings_medium.yml | 2 - ...ontainer_upload_outside_business_hours.yml | 2 - .../aws_ecr_container_upload_unknown_user.yml | 2 - .../cloud/aws_excessive_security_scanning.yml | 2 - .../aws_iam_accessdenied_discovery_events.yml | 2 - ...aws_iam_assume_role_policy_brute_force.yml | 2 - detections/cloud/aws_iam_delete_policy.yml | 2 - .../cloud/aws_iam_failure_group_deletion.yml | 2 - .../aws_iam_successful_group_deletion.yml | 2 - .../cloud/aws_lambda_updatefunctioncode.yml | 2 - ...s_multi_factor_authentication_disabled.yml | 2 - ..._multiple_failed_mfa_requests_for_user.yml | 2 - ..._users_failing_to_authenticate_from_ip.yml | 2 - ...ntrol_list_created_with_all_open_ports.yml | 2 - ...ws_network_access_control_list_deleted.yml | 2 - ..._access_by_provider_user_and_principal.yml | 2 - .../aws_saml_update_identity_provider.yml | 2 - .../cloud/aws_setdefaultpolicyversion.yml | 2 - ...uccessful_single_factor_authentication.yml | 2 - ...mber_of_failed_authentications_from_ip.yml | 2 - detections/cloud/aws_updateloginprofile.yml | 2 - ...ure_active_directory_high_risk_sign_in.yml | 2 - ...entication_failed_during_mfa_challenge.yml | 2 - .../azure_ad_external_guest_user_invited.yml | 2 - ..._ad_global_administrator_role_assigned.yml | 2 - ...d_multi_factor_authentication_disabled.yml | 2 - ..._multiple_failed_mfa_requests_for_user.yml | 2 - ..._users_failing_to_authenticate_from_ip.yml | 2 - .../azure_ad_new_custom_domain_added.yml | 2 - .../azure_ad_new_federated_domain_added.yml | 2 - .../azure_ad_privileged_role_assigned.yml | 2 - .../azure_ad_service_principal_created.yml | 2 - ...rvice_principal_new_client_credentials.yml | 2 - ...azure_ad_service_principal_owner_added.yml | 2 - ...d_successful_powershell_authentication.yml | 2 - ...uccessful_single_factor_authentication.yml | 2 - ...mber_of_failed_authentications_from_ip.yml | 2 - ...ure_ad_user_enabled_and_password_reset.yml | 2 - ..._ad_user_immutableid_attribute_updated.yml | 2 - .../azure_automation_account_created.yml | 2 - .../azure_automation_runbook_created.yml | 2 - .../cloud/azure_runbook_webhook_created.yml | 2 - .../cloud/circle_ci_disable_security_job.yml | 2 - .../cloud/circle_ci_disable_security_step.yml | 2 - ...alls_from_previously_unseen_user_roles.yml | 2 - ...ance_created_by_previously_unseen_user.yml | 2 - ...ce_created_in_previously_unused_region.yml | 2 - ...e_created_with_previously_unseen_image.yml | 2 - ...d_with_previously_unseen_instance_type.yml | 2 - ...nce_modified_by_previously_unseen_user.yml | 2 - ...g_activity_from_previously_unseen_city.yml | 2 - ...ctivity_from_previously_unseen_country.yml | 2 - ...vity_from_previously_unseen_ip_address.yml | 2 - ...activity_from_previously_unseen_region.yml | 2 - .../correlation_by_repository_and_risk.yml | 2 - .../cloud/correlation_by_user_and_risk.yml | 2 - .../detect_aws_console_login_by_new_user.yml | 2 - ...ws_console_login_by_user_from_new_city.yml | 2 - ...console_login_by_user_from_new_country.yml | 2 - ..._console_login_by_user_from_new_region.yml | 2 - ...etect_gcp_storage_access_from_a_new_ip.yml | 2 - .../detect_new_open_gcp_storage_buckets.yml | 2 - .../cloud/detect_new_open_s3_buckets.yml | 2 - ...etect_new_open_s3_buckets_over_aws_cli.yml | 2 - .../cloud/detect_s3_access_from_a_new_ip.yml | 2 - .../cloud/detect_shared_ec2_snapshot.yml | 2 - ...s_security_hub_alerts_for_ec2_instance.yml | 2 - ...ke_in_aws_security_hub_alerts_for_user.yml | 2 - ...blocked_outbound_traffic_from_your_aws.yml | 2 - .../detect_spike_in_s3_bucket_deletion.yml | 2 - ...entication_failed_during_mfa_challenge.yml | 2 - .../cloud/gcp_detect_gcploit_framework.yml | 2 - ..._kubernetes_cluster_pod_scan_detection.yml | 2 - ...p_multi_factor_authentication_disabled.yml | 2 - ..._multiple_failed_mfa_requests_for_user.yml | 2 - ..._users_failing_to_authenticate_from_ip.yml | 2 - ...uccessful_single_factor_authentication.yml | 2 - ...mber_of_failed_authentications_from_ip.yml | 2 - .../cloud/gdrive_suspicious_file_sharing.yml | 2 - ...thub_actions_disable_security_workflow.yml | 2 - .../cloud/github_commit_changes_in_master.yml | 2 - detections/cloud/github_commit_in_develop.yml | 2 - detections/cloud/github_dependabot_alert.yml | 2 - .../github_pull_request_from_unknown_user.yml | 2 - .../gsuite_drive_share_in_external_email.yml | 2 - .../gsuite_email_suspicious_attachment.yml | 2 - ...ail_suspicious_subject_with_attachment.yml | 2 - ...mail_with_known_abuse_web_service_link.yml | 2 - ...ail_with_attachment_to_external_domain.yml | 2 - .../gsuite_suspicious_calendar_invite.yml | 2 - .../gsuite_suspicious_shared_file_name.yml | 2 - ...of_login_failures_from_a_single_source.yml | 2 - ...es_aws_detect_suspicious_kubectl_calls.yml | 2 - .../cloud/kubernetes_nginx_ingress_lfi.yml | 2 - .../cloud/kubernetes_nginx_ingress_rfi.yml | 2 - .../kubernetes_scanner_image_pulling.yml | 2 - ...365_add_app_role_assignment_grant_user.yml | 2 - .../cloud/o365_added_service_principal.yml | 2 - .../cloud/o365_bypass_mfa_via_trusted_ip.yml | 2 - detections/cloud/o365_disable_mfa.yml | 2 - ...xcessive_authentication_failures_alert.yml | 2 - .../cloud/o365_excessive_sso_logon_errors.yml | 2 - .../cloud/o365_new_federated_domain_added.yml | 2 - detections/cloud/o365_pst_export_alert.yml | 2 - ...o365_suspicious_admin_email_forwarding.yml | 2 - .../o365_suspicious_rights_delegation.yml | 2 - .../o365_suspicious_user_email_forwarding.yml | 2 - ...ly_high_aws_instances_launched_by_user.yml | 2 - ..._aws_instances_launched_by_user___mltk.yml | 2 - ..._high_aws_instances_terminated_by_user.yml | 2 - ...ws_instances_terminated_by_user___mltk.yml | 2 - ...ovisioning_from_previously_unseen_city.yml | 2 - ...sioning_from_previously_unseen_country.yml | 2 - ...ning_from_previously_unseen_ip_address.yml | 2 - ...isioning_from_previously_unseen_region.yml | 2 - ...rnetes_cluster_sensitive_object_access.yml | 2 - ...nts_connecting_to_multiple_dns_servers.yml | 2 - ...ud_network_access_control_list_deleted.yml | 2 - ...ct_api_activity_from_users_without_mfa.yml | 2 - ...pi_activities_from_unapproved_accounts.yml | 2 - ...to_phishing_sites_leveraging_evilginx2.yml | 2 - .../detect_long_dns_txt_record_response.yml | 2 - ...katz_via_powershell_and_eventcode_4703.yml | 2 - .../detect_new_api_calls_from_user_roles.yml | 2 - .../detect_new_user_aws_console_login.yml | 2 - .../detect_spike_in_aws_api_activity.yml | 2 - .../detect_spike_in_network_acl_activity.yml | 2 - ...etect_spike_in_security_group_activity.yml | 2 - .../detect_usb_device_insertion.yml | 2 - ...eb_traffic_to_dynamic_domain_providers.yml | 2 - .../deprecated/detection_of_dns_tunnels.yml | 2 - ...s_resolved_by_unauthorized_dns_servers.yml | 2 - detections/deprecated/dns_record_changed.yml | 2 - .../dump_lsass_via_procdump_rename.yml | 2 - ...e_modified_with_previously_unseen_user.yml | 2 - ...ce_started_in_previously_unseen_region.yml | 2 - ...nce_started_with_previously_unseen_ami.yml | 2 - ...d_with_previously_unseen_instance_type.yml | 2 - ...ce_started_with_previously_unseen_user.yml | 2 - ...n_of_file_with_spaces_before_extension.yml | 2 - ...d_without_successful_netbackup_backups.yml | 2 - .../first_time_seen_command_line_argument.yml | 2 - ...counts_with_high_risk_roles_by_project.yml | 2 - ...sk_permissions_by_resource_and_account.yml | 2 - .../gcp_detect_oauth_token_abuse.yml | 2 - .../gcp_kubernetes_cluster_scan_detection.yml | 2 - .../deprecated/identify_new_user_accounts.yml | 2 - ...ct_most_active_service_accounts_by_pod.yml | 2 - ...s_detect_rbac_authorization_by_account.yml | 2 - ...netes_aws_detect_sensitive_role_access.yml | 2 - ...vice_accounts_forbidden_failure_access.yml | 2 - ...tive_service_accounts_by_pod_namespace.yml | 2 - ...e_detect_rbac_authorization_by_account.yml | 2 - ...s_azure_detect_sensitive_object_access.yml | 2 - ...tes_azure_detect_sensitive_role_access.yml | 2 - ...vice_accounts_forbidden_failure_access.yml | 2 - ..._azure_detect_suspicious_kubectl_calls.yml | 2 - .../kubernetes_azure_pod_scan_fingerprint.yml | 2 - .../kubernetes_azure_scan_fingerprint.yml | 2 - ...ct_most_active_service_accounts_by_pod.yml | 2 - ..._detect_rbac_authorizations_by_account.yml | 2 - ...tes_gcp_detect_sensitive_object_access.yml | 2 - ...netes_gcp_detect_sensitive_role_access.yml | 2 - ...vice_accounts_forbidden_failure_access.yml | 2 - ...es_gcp_detect_suspicious_kubectl_calls.yml | 2 - .../monitor_dns_for_brand_abuse.yml | 2 - .../open_redirect_in_splunk_web.yml | 2 - .../osquery_pack___coldroot_detection.yml | 2 - .../deprecated/processes_created_by_netsh.yml | 2 - .../prohibited_software_on_endpoint.yml | 2 - ...de_files_directories_via_registry_keys.yml | 2 - .../remote_registry_key_modifications.yml | 2 - ...led_tasks_used_in_badrabbit_ransomware.yml | 2 - ...pectre_and_meltdown_vulnerable_systems.yml | 2 - ...lunk_enterprise_information_disclosure.yml | 2 - ...uspicious_changes_to_file_associations.yml | 2 - .../suspicious_email___uba_anomaly.yml | 2 - .../deprecated/suspicious_file_write.yml | 2 - ...ious_powershell_command_line_arguments.yml | 2 - .../deprecated/suspicious_rundll32_rename.yml | 2 - ...us_writes_to_system_volume_information.yml | 2 - .../uncommon_processes_on_endpoint.yml | 2 - .../unsigned_image_loaded_by_lsass.yml | 2 - .../unsuccessful_netbackup_backups.yml | 2 - .../web_fraud___account_harvesting.yml | 2 - .../web_fraud___anomalous_user_clickspeed.yml | 2 - ...aud___password_sharing_across_accounts.yml | 2 - ...indows_connhost_exe_started_forcefully.yml | 2 - .../windows_hosts_file_modification.yml | 2 - .../7zip_commandline_to_smb_share_path.yml | 2 - .../access_lsass_memory_for_dump_creation.yml | 2 - .../account_discovery_with_net_app.yml | 2 - .../active_setup_registry_autostart.yml | 2 - ...d_defaultuser_and_password_in_registry.yml | 2 - .../add_or_set_windows_defender_exclusion.yml | 2 - .../adsisearcher_account_discovery.yml | 2 - ..._file_and_printing_sharing_in_firewall.yml | 2 - ...ound_traffic_by_firewall_rule_registry.yml | 2 - ...allow_inbound_traffic_in_firewall_rule.yml | 2 - .../allow_network_discovery_in_firewall.yml | 2 - .../allow_operation_with_consent_admin.yml | 2 - .../endpoint/anomalous_usage_of_7zip.yml | 2 - .../endpoint/any_powershell_downloadfile.yml | 2 - .../any_powershell_downloadstring.yml | 2 - .../endpoint/attacker_tools_on_endpoint.yml | 2 - ..._to_add_certificate_to_untrusted_store.yml | 2 - .../attempt_to_stop_security_service.yml | 2 - ...dential_dump_from_registry_via_reg_exe.yml | 2 - .../auto_admin_logon_registry_entry.yml | 2 - .../endpoint/batch_file_write_to_system32.yml | 2 - ...dedit_command_back_to_normal_mode_boot.yml | 2 - .../bcdedit_failure_recovery_modification.yml | 2 - detections/endpoint/bits_job_persistence.yml | 2 - .../endpoint/bitsadmin_download_file.yml | 2 - ...load_with_urlcache_and_split_arguments.yml | 2 - ...oad_with_verifyctl_and_split_arguments.yml | 2 - .../certutil_exe_certificate_extraction.yml | 2 - .../certutil_with_decode_argument.yml | 2 - .../change_default_file_association.yml | 2 - ...hange_to_safe_mode_with_network_config.yml | 2 - .../endpoint/chcp_command_execution.yml | 2 - .../check_elevated_cmd_using_whoami.yml | 2 - .../child_processes_of_spoolsv_exe.yml | 2 - ...ar_unallocated_sector_using_cipher_app.yml | 2 - .../endpoint/clop_common_exec_parameter.yml | 2 - .../clop_ransomware_known_service_name.yml | 2 - ...cmd_carry_out_string_command_parameter.yml | 2 - .../endpoint/cmd_echo_pipe___escalation.yml | 2 - ...cmdline_tool_not_executed_in_cmd_shell.yml | 2 - .../endpoint/cmlua_or_cmstplua_uac_bypass.yml | 2 - .../endpoint/cobalt_strike_named_pipes.yml | 2 - .../endpoint/common_ransomware_extensions.yml | 2 - .../endpoint/common_ransomware_notes.yml | 2 - .../endpoint/conti_common_exec_parameter.yml | 2 - ..._loading_from_world_writable_directory.yml | 2 - ...ate_local_admin_accounts_using_net_exe.yml | 2 - ...or_delete_windows_shares_using_net_exe.yml | 2 - ...ate_remote_thread_in_shell_application.yml | 2 - .../create_remote_thread_into_lsass.yml | 2 - .../creation_of_lsass_dump_with_taskmgr.yml | 2 - .../endpoint/creation_of_shadow_copy.yml | 2 - ...f_shadow_copy_with_wmic_and_powershell.yml | 2 - ...ping_via_copy_command_from_shadow_copy.yml | 2 - ...ial_dumping_via_symlink_to_shadow_copy.yml | 2 - .../csc_net_on_the_fly_compilation.yml | 2 - .../curl_download_and_bash_execution.yml | 2 - .../delete_shadowcopy_with_powershell.yml | 2 - detections/endpoint/deleting_of_net_users.yml | 2 - .../endpoint/deleting_shadow_copies.yml | 2 - ...ivity_related_to_pass_the_hash_attacks.yml | 2 - ...tect_azurehound_command_line_arguments.yml | 2 - .../detect_azurehound_file_modifications.yml | 2 - .../detect_baron_samedit_cve_2021_3156.yml | 2 - ...t_baron_samedit_cve_2021_3156_segfault.yml | 2 - ...aron_samedit_cve_2021_3156_via_osquery.yml | 2 - ...omputer_changed_with_anonymous_account.yml | 2 - ...f_shadowcopy_with_script_block_logging.yml | 2 - ...redential_dumping_through_lsass_access.yml | 2 - ...e_with_powershell_script_block_logging.yml | 2 - ...cessive_account_lockouts_from_endpoint.yml | 2 - ...detect_excessive_user_account_lockouts.yml | 2 - .../endpoint/detect_exchange_web_shell.yml | 2 - .../endpoint/detect_html_help_renamed.yml | 2 - .../detect_html_help_spawn_child_process.yml | 2 - .../detect_html_help_url_in_command_line.yml | 2 - ...l_help_using_infotech_storage_handlers.yml | 2 - .../detect_mimikatz_using_loaded_images.yml | 2 - ...z_with_powershell_script_block_logging.yml | 2 - .../detect_mshta_inline_hta_execution.yml | 2 - detections/endpoint/detect_mshta_renamed.yml | 2 - .../detect_mshta_url_in_command_line.yml | 2 - .../detect_new_local_admin_account.yml | 2 - .../detect_outlook_exe_writing_a_zip_file.yml | 2 - ...nterception_by_creation_of_program_exe.yml | 2 - ...system_network_configuration_discovery.yml | 2 - ...ohibited_applications_spawning_cmd_exe.yml | 2 - .../detect_psexec_with_accepteula_flag.yml | 2 - .../endpoint/detect_rare_executables.yml | 2 - .../detect_rclone_command_line_usage.yml | 2 - .../detect_regasm_spawning_a_process.yml | 2 - .../detect_regasm_with_network_connection.yml | 2 - ..._regasm_with_no_command_line_arguments.yml | 2 - .../detect_regsvcs_spawning_a_process.yml | 2 - ...detect_regsvcs_with_network_connection.yml | 2 - ...regsvcs_with_no_command_line_arguments.yml | 2 - ...ct_regsvr32_application_control_bypass.yml | 2 - detections/endpoint/detect_renamed_7_zip.yml | 2 - detections/endpoint/detect_renamed_psexec.yml | 2 - detections/endpoint/detect_renamed_rclone.yml | 2 - detections/endpoint/detect_renamed_winrar.yml | 2 - ...2_application_control_bypass___advpack.yml | 2 - ..._application_control_bypass___setupapi.yml | 2 - ..._application_control_bypass___syssetup.yml | 2 - .../detect_rundll32_inline_hta_execution.yml | 2 - ...tect_sharphound_command_line_arguments.yml | 2 - .../detect_sharphound_file_modifications.yml | 2 - .../endpoint/detect_sharphound_usage.yml | 2 - ..._cmd_exe_to_launch_script_interpreters.yml | 2 - ...ect_wmi_event_subscription_persistence.yml | 2 - .../detection_of_tools_built_by_nirsoft.yml | 2 - .../disable_amsi_through_registry.yml | 2 - .../disable_defender_antivirus_registry.yml | 2 - ...able_defender_blockatfirstseen_feature.yml | 2 - ...disable_defender_enhanced_notification.yml | 2 - .../disable_defender_mpengine_registry.yml | 2 - .../disable_defender_spynet_reporting.yml | 2 - ...efender_submit_samples_consent_feature.yml | 2 - .../endpoint/disable_etw_through_registry.yml | 2 - .../endpoint/disable_logs_using_wevtutil.yml | 2 - detections/endpoint/disable_registry_tool.yml | 2 - detections/endpoint/disable_schedule_task.yml | 2 - ...le_security_logs_using_minint_registry.yml | 2 - .../endpoint/disable_show_hidden_files.yml | 2 - .../disable_uac_remote_restriction.yml | 2 - .../endpoint/disable_windows_app_hotkeys.yml | 2 - .../disable_windows_behavior_monitoring.yml | 2 - ...disable_windows_smartscreen_protection.yml | 2 - ...thentication_discovery_with_get_aduser.yml | 2 - ...uthentication_discovery_with_powerview.yml | 2 - .../endpoint/disabling_cmd_application.yml | 2 - .../endpoint/disabling_controlpanel.yml | 2 - .../endpoint/disabling_defender_services.yml | 2 - .../disabling_firewall_with_netsh.yml | 2 - ...isabling_folderoptions_windows_feature.yml | 2 - .../endpoint/disabling_net_user_account.yml | 2 - .../endpoint/disabling_norun_windows_app.yml | 2 - .../disabling_remote_user_account_control.yml | 2 - .../disabling_systemrestore_in_registry.yml | 2 - .../endpoint/disabling_task_manager.yml | 2 - ...no_command_line_arguments_with_network.yml | 2 - .../dns_exfiltration_using_nslookup_app.yml | 2 - .../domain_account_discovery_with_dsquery.yml | 2 - .../domain_account_discovery_with_net_app.yml | 2 - .../domain_account_discovery_with_wmic.yml | 2 - ...omain_controller_discovery_with_nltest.yml | 2 - .../domain_controller_discovery_with_wmic.yml | 2 - ...main_group_discovery_with_adsisearcher.yml | 2 - .../domain_group_discovery_with_dsquery.yml | 2 - .../domain_group_discovery_with_net.yml | 2 - .../domain_group_discovery_with_wmic.yml | 2 - .../download_files_using_telegram.yml | 2 - .../endpoint/drop_icedid_license_dat.yml | 2 - .../endpoint/dsquery_domain_discovery.yml | 2 - .../endpoint/dump_lsass_via_comsvcs_dll.yml | 2 - .../endpoint/dump_lsass_via_procdump.yml | 2 - .../elevated_group_discovery_with_net.yml | 2 - ...levated_group_discovery_with_powerview.yml | 2 - .../elevated_group_discovery_with_wmic.yml | 2 - .../enable_rdp_in_other_port_number.yml | 2 - ...le_wdigest_uselogoncredential_registry.yml | 2 - ...erate_users_local_group_using_telegram.yml | 2 - detections/endpoint/esentutl_sam_copy.yml | 2 - detections/endpoint/etw_registry_disabled.yml | 2 - detections/endpoint/eventvwr_uac_bypass.yml | 2 - .../endpoint/excel_spawning_powershell.yml | 2 - .../excel_spawning_windows_script_host.yml | 2 - .../excessive_attempt_to_disable_services.yml | 2 - ...e_distinct_processes_from_windows_temp.yml | 2 - ...ve_file_deletion_in_windefender_folder.yml | 2 - ...r_of_service_control_start_as_disabled.yml | 2 - ...excessive_number_of_taskhost_processes.yml | 2 - .../excessive_service_stop_attempt.yml | 2 - .../endpoint/excessive_usage_of_cacls_app.yml | 2 - .../endpoint/excessive_usage_of_net_app.yml | 2 - .../excessive_usage_of_nslookup_app.yml | 2 - .../excessive_usage_of_sc_service_utility.yml | 2 - .../endpoint/excessive_usage_of_taskkill.yml | 2 - .../exchange_powershell_abuse_via_ssrf.yml | 2 - .../exchange_powershell_module_usage.yml | 2 - ...le_written_in_administrative_smb_share.yml | 2 - ..._or_script_creation_in_suspicious_path.yml | 2 - ...cute_javascript_with_jscript_com_clsid.yml | 2 - ...ution_of_file_with_multiple_extensions.yml | 2 - .../endpoint/extraction_of_registry_hives.yml | 2 - .../endpoint/file_with_samsam_extension.yml | 2 - .../firewall_allowed_program_enable.yml | 2 - .../first_time_seen_child_process_of_zoom.yml | 2 - ...irst_time_seen_running_windows_service.yml | 2 - detections/endpoint/fodhelper_uac_bypass.yml | 2 - detections/endpoint/fsutil_zeroing_file.yml | 2 - ...ltdomainpasswordpolicy_with_powershell.yml | 2 - ...ordpolicy_with_powershell_script_block.yml | 2 - .../endpoint/get_aduser_with_powershell.yml | 2 - ...et_aduser_with_powershell_script_block.yml | 2 - ...esultantpasswordpolicy_with_powershell.yml | 2 - ...ordpolicy_with_powershell_script_block.yml | 2 - .../get_domainpolicy_with_powershell.yml | 2 - ...ainpolicy_with_powershell_script_block.yml | 2 - .../get_domaintrust_with_powershell.yml | 2 - ...maintrust_with_powershell_script_block.yml | 2 - .../get_domainuser_with_powershell.yml | 2 - ...omainuser_with_powershell_script_block.yml | 2 - .../get_foresttrust_with_powershell.yml | 2 - ...resttrust_with_powershell_script_block.yml | 2 - .../get_wmiobject_group_discovery.yml | 2 - ...up_discovery_with_script_block_logging.yml | 2 - .../getadcomputer_with_powershell.yml | 2 - ...dcomputer_with_powershell_script_block.yml | 2 - .../endpoint/getadgroup_with_powershell.yml | 2 - ...etadgroup_with_powershell_script_block.yml | 2 - .../getcurrent_user_with_powershell.yml | 2 - ...rent_user_with_powershell_script_block.yml | 2 - .../getdomaincomputer_with_powershell.yml | 2 - ...ncomputer_with_powershell_script_block.yml | 2 - .../getdomaincontroller_with_powershell.yml | 2 - ...ontroller_with_powershell_script_block.yml | 2 - .../getdomaingroup_with_powershell.yml | 2 - ...maingroup_with_powershell_script_block.yml | 2 - .../endpoint/getlocaluser_with_powershell.yml | 2 - ...localuser_with_powershell_script_block.yml | 2 - .../getnettcpconnection_with_powershell.yml | 2 - ...onnection_with_powershell_script_block.yml | 2 - ...twmiobject_ds_computer_with_powershell.yml | 2 - ..._computer_with_powershell_script_block.yml | 2 - .../getwmiobject_ds_group_with_powershell.yml | 2 - ..._ds_group_with_powershell_script_block.yml | 2 - .../getwmiobject_ds_user_with_powershell.yml | 2 - ...t_ds_user_with_powershell_script_block.yml | 2 - ...wmiobject_user_account_with_powershell.yml | 2 - ...r_account_with_powershell_script_block.yml | 2 - ...no_command_line_arguments_with_network.yml | 2 - .../hide_user_account_from_sign_in_screen.yml | 2 - ..._files_and_directories_with_attrib_exe.yml | 2 - ...equency_copy_of_files_in_network_share.yml | 2 - .../high_process_termination_frequency.yml | 2 - detections/endpoint/hunting_for_log4shell.yml | 111 ------------------ detections/endpoint/icacls_deny_command.yml | 2 - detections/endpoint/icacls_grant_command.yml | 2 - ...did_exfiltrated_archived_file_creation.yml | 2 - ...ateral_movement_commandline_parameters.yml | 2 - ...ion_on_remote_endpoint_with_powershell.yml | 2 - ...class_file_download_by_java_user_agent.yml | 2 - detections/endpoint/java_writing_jsp_file.yml | 2 - .../jscript_execution_using_cscript_app.yml | 2 - ...asting_spn_request_with_rc4_encryption.yml | 2 - ...on_flag_disabled_in_useraccountcontrol.yml | 2 - ...tication_flag_disabled_with_powershell.yml | 2 - ...ce_ticket_request_using_rc4_encryption.yml | 2 - ...beros_tgt_request_using_rc4_encryption.yml | 2 - .../endpoint/kerberos_user_enumeration.yml | 2 - .../known_services_killed_by_ransomware.yml | 2 - ...nt_manipulation_of_ssh_config_and_keys.yml | 2 - ...add_files_in_known_crontab_directories.yml | 2 - .../endpoint/linux_add_user_account.yml | 2 - ...ux_adding_crontab_using_list_parameter.yml | 2 - .../linux_apt_get_privilege_escalation.yml | 2 - .../linux_apt_privilege_escalation.yml | 2 - .../linux_at_allow_config_file_creation.yml | 2 - .../linux_at_application_execution.yml | 2 - .../linux_awk_privilege_escalation.yml | 2 - .../linux_busybox_privilege_escalation.yml | 2 - .../linux_c89_privilege_escalation.yml | 2 - .../linux_c99_privilege_escalation.yml | 2 - .../linux_change_file_owner_to_root.yml | 2 - .../endpoint/linux_clipboard_data_copy.yml | 2 - ...x_common_process_for_elevation_control.yml | 2 - .../linux_composer_privilege_escalation.yml | 2 - .../linux_cpulimit_privilege_escalation.yml | 2 - .../linux_csvtool_privilege_escalation.yml | 2 - .../endpoint/linux_curl_upload_file.yml | 2 - .../endpoint/linux_dd_file_overwrite.yml | 2 - .../endpoint/linux_decode_base64_to_shell.yml | 2 - ...ng_critical_directory_using_rm_command.yml | 2 - .../endpoint/linux_deletion_of_cron_jobs.yml | 2 - .../linux_deletion_of_init_daemon_script.yml | 2 - .../endpoint/linux_deletion_of_services.yml | 2 - .../linux_deletion_of_ssl_certificate.yml | 2 - .../endpoint/linux_disable_services.yml | 2 - .../linux_doas_conf_file_creation.yml | 2 - .../endpoint/linux_doas_tool_execution.yml | 2 - .../linux_docker_privilege_escalation.yml | 2 - .../linux_edit_cron_table_parameter.yml | 2 - .../linux_emacs_privilege_escalation.yml | 2 - ...ile_created_in_kernel_driver_directory.yml | 2 - ...x_file_creation_in_init_boot_directory.yml | 2 - ...nux_file_creation_in_profile_directory.yml | 2 - .../linux_find_privilege_escalation.yml | 2 - .../linux_gdb_privilege_escalation.yml | 2 - .../linux_gem_privilege_escalation.yml | 2 - .../linux_gnu_awk_privilege_escalation.yml | 2 - ...quency_of_file_deletion_in_boot_folder.yml | 2 - ...equency_of_file_deletion_in_etc_folder.yml | 2 - .../linux_ingress_tool_transfer_hunting.yml | 2 - .../linux_ingress_tool_transfer_with_curl.yml | 2 - ...ert_kernel_module_using_insmod_utility.yml | 2 - ...l_kernel_module_using_modprobe_utility.yml | 2 - .../linux_iptables_firewall_modification.yml | 2 - .../endpoint/linux_java_spawning_shell.yml | 2 - .../linux_kernel_module_enumeration.yml | 2 - ...orker_process_in_writable_process_path.yml | 2 - .../linux_make_privilege_escalation.yml | 2 - .../linux_mysql_privilege_escalation.yml | 2 - .../linux_node_privilege_escalation.yml | 2 - .../linux_nopasswd_entry_in_sudoers_file.yml | 2 - ...ted_files_or_information_base64_decode.yml | 2 - .../linux_octave_privilege_escalation.yml | 2 - .../linux_openvpn_privilege_escalation.yml | 2 - ...and_privilege_escalation_risk_behavior.yml | 2 - .../linux_php_privilege_escalation.yml | 2 - .../linux_pkexec_privilege_escalation.yml | 2 - ...ss_or_modification_of_sshd_config_file.yml | 2 - ...ux_possible_access_to_credential_files.yml | 2 - .../linux_possible_access_to_sudoers_file.yml | 2 - ...append_command_to_at_allow_config_file.yml | 2 - ..._append_command_to_profile_config_file.yml | 2 - ...cronjob_entry_on_existing_cronjob_file.yml | 2 - ...sible_cronjob_modification_with_editor.yml | 2 - .../linux_possible_ssh_key_file_creation.yml | 2 - .../linux_preload_hijack_library_calls.yml | 2 - .../endpoint/linux_proxy_socks_curl.yml | 2 - .../linux_puppet_privilege_escalation.yml | 2 - .../linux_rpm_privilege_escalation.yml | 2 - .../linux_ruby_privilege_escalation.yml | 2 - ...vice_file_created_in_systemd_directory.yml | 2 - .../endpoint/linux_service_restarted.yml | 2 - .../linux_service_started_or_enabled.yml | 2 - .../linux_setuid_using_chmod_utility.yml | 2 - .../linux_setuid_using_setcap_utility.yml | 2 - .../linux_shred_overwrite_command.yml | 2 - .../linux_sqlite3_privilege_escalation.yml | 2 - ...linux_ssh_authorized_keys_modification.yml | 2 - ...nux_ssh_remote_services_script_execute.yml | 2 - ...ux_stdout_redirection_to_dev_null_file.yml | 2 - detections/endpoint/linux_stop_services.yml | 2 - .../endpoint/linux_sudo_or_su_execution.yml | 2 - .../linux_sudoers_tmp_file_creation.yml | 2 - .../linux_system_network_discovery.yml | 2 - .../linux_visudo_utility_execution.yml | 2 - detections/endpoint/living_off_the_land.yml | 2 - .../endpoint/loading_of_dynwrapx_module.yml | 2 - .../local_account_discovery_with_net.yml | 2 - .../local_account_discovery_with_wmic.yml | 2 - .../log4shell_cve_2021_44228_exploitation.yml | 2 - .../logon_script_event_trigger_execution.yml | 2 - .../macos___re_opened_applications.yml | 2 - detections/endpoint/macos_lolbin.yml | 2 - detections/endpoint/macos_plutil.yml | 2 - .../endpoint/mailsniper_invoke_functions.yml | 2 - .../malicious_inprocserver32_modification.yml | 2 - ...cious_powershell_executed_as_a_service.yml | 2 - ...s_powershell_process___encoded_command.yml | 2 - ...hell_process___execution_policy_bypass.yml | 2 - ...ll_process_with_obfuscation_techniques.yml | 2 - ...z_passtheticket_commandline_parameters.yml | 2 - .../mmc_lolbas_execution_process_spawn.yml | 2 - .../endpoint/modification_of_wallpaper.yml | 2 - ...dify_acl_permission_to_files_or_folder.yml | 2 - ...nitor_registry_keys_for_print_monitors.yml | 2 - ...on_service_writing_active_server_pages.yml | 2 - ..._scripting_process_loading_ldap_module.yml | 2 - ...s_scripting_process_loading_wmi_module.yml | 2 - ...d_suspicious_spawned_by_script_process.yml | 2 - ..._spawning_rundll32_or_regsvr32_process.yml | 2 - .../mshtml_module_load_in_office_product.yml | 2 - ...msi_module_loaded_by_non_system_binary.yml | 2 - .../msmpeng_application_dll_side_loading.yml | 2 - ...g_to_authenticate_from_host_using_ntlm.yml | 2 - ..._authenticate_from_host_using_kerberos.yml | 2 - ...g_to_authenticate_from_host_using_ntlm.yml | 2 - ...s_failing_to_authenticate_from_process.yml | 2 - ...tely_failing_to_authenticate_from_host.yml | 2 - .../endpoint/net_localgroup_discovery.yml | 2 - .../endpoint/net_profiler_uac_bypass.yml | 2 - .../network_connection_discovery_with_arp.yml | 2 - .../network_connection_discovery_with_net.yml | 2 - ...work_connection_discovery_with_netstat.yml | 2 - ...work_discovery_using_route_windows_app.yml | 2 - .../endpoint/nishang_powershelltcponeline.yml | 2 - .../nltest_domain_trust_discovery.yml | 2 - ...e_process_accessing_chrome_default_dir.yml | 2 - ...fox_process_access_firefox_profile_dir.yml | 2 - detections/endpoint/ntdsutil_export_ntds.yml | 2 - .../office_application_drop_executable.yml | 2 - ...ice_application_spawn_regsvr32_process.yml | 2 - ...ice_application_spawn_rundll32_process.yml | 2 - ...office_document_creating_schedule_task.yml | 2 - .../office_document_executing_macro_code.yml | 2 - ...ment_spawned_child_process_to_download.yml | 2 - .../office_product_spawn_cmd_process.yml | 2 - .../office_product_spawning_bitsadmin.yml | 2 - .../office_product_spawning_certutil.yml | 2 - .../office_product_spawning_mshta.yml | 2 - ..._product_spawning_rundll32_with_no_dll.yml | 2 - ...e_product_spawning_windows_script_host.yml | 2 - .../endpoint/office_product_spawning_wmic.yml | 2 - .../office_product_writing_cab_or_inf.yml | 2 - .../endpoint/office_spawning_control.yml | 2 - ...nnection_from_java_using_default_ports.yml | 2 - .../overwriting_accessibility_binaries.yml | 2 - .../password_policy_discovery_with_net.yml | 2 - ...mission_modification_using_takeown_app.yml | 2 - ...etitpotam_network_share_access_request.yml | 2 - ...tpotam_suspicious_kerberos_tgt_request.yml | 2 - .../endpoint/ping_sleep_batch_command.yml | 2 - .../possible_browser_pass_view_parameter.yml | 2 - ...ible_lateral_movement_powershell_spawn.yml | 2 - .../potential_password_in_username.yml | 2 - ...entially_malicious_code_on_commandline.yml | 2 - .../endpoint/powershell_4104_hunting.yml | 2 - ...connect_to_internet_with_hidden_window.yml | 2 - ..._hijacking_inprocserver32_modification.yml | 2 - .../powershell_creating_thread_mutex.yml | 2 - ...powershell_disable_security_monitoring.yml | 2 - .../powershell_domain_enumeration.yml | 2 - ...powershell_enable_smb1protocol_feature.yml | 2 - .../powershell_execute_com_object.yml | 2 - ...s_process_injection_via_getprocaddress.yml | 2 - ...script_contains_base64_encoded_content.yml | 2 - .../powershell_get_localgroup_discovery.yml | 2 - ...up_discovery_with_script_block_logging.yml | 2 - .../powershell_load_module_in_meterpreter.yml | 2 - ...ding_dotnet_into_memory_via_reflection.yml | 2 - .../powershell_processing_stream_of_data.yml | 2 - ...remote_thread_to_known_windows_process.yml | 2 - ...hell_remove_windows_defender_directory.yml | 2 - .../powershell_start_bitstransfer.yml | 2 - ...wershell_using_memory_as_backing_store.yml | 2 - ...ll_windows_defender_exclusion_commands.yml | 2 - ...nt_automatic_repair_mode_using_bcdedit.yml | 2 - .../print_processor_registry_autostart.yml | 2 - .../print_spooler_adding_a_printer_driver.yml | 2 - ...print_spooler_failed_to_load_a_plug_in.yml | 2 - ...eating_lnk_file_in_suspicious_location.yml | 2 - ...process_deleting_its_process_file_path.yml | 2 - .../endpoint/process_execution_via_wmi.yml | 2 - .../process_kill_base_on_file_path.yml | 2 - .../process_writing_dynamicwrapperx.yml | 2 - .../endpoint/processes_launching_netsh.yml | 2 - .../processes_tapping_keyboard_events.yml | 2 - ...randomly_generated_scheduled_task_name.yml | 2 - ...andomly_generated_windows_service_name.yml | 2 - .../ransomware_notes_bulk_creation.yml | 2 - .../recon_avproduct_through_pwh_or_wmi.yml | 2 - detections/endpoint/recon_using_wmi_class.yml | 2 - ...rsive_delete_of_directory_in_batch_cmd.yml | 2 - ...ulating_windows_services_registry_keys.yml | 2 - ...istry_keys_for_creating_shim_databases.yml | 2 - .../registry_keys_used_for_persistence.yml | 2 - ...try_keys_used_for_privilege_escalation.yml | 2 - ...2_silent_and_install_param_dll_loading.yml | 2 - ...svr32_with_known_silent_switch_cmdline.yml | 2 - .../remcos_client_registry_install_entry.yml | 2 - ...cos_rat_file_creation_in_remcos_folder.yml | 2 - ...mote_desktop_process_running_on_system.yml | 2 - ..._instantiation_via_dcom_and_powershell.yml | 2 - ...n_via_dcom_and_powershell_script_block.yml | 2 - ...instantiation_via_winrm_and_powershell.yml | 2 - ..._via_winrm_and_powershell_script_block.yml | 2 - ...cess_instantiation_via_winrm_and_winrs.yml | 2 - .../remote_process_instantiation_via_wmi.yml | 2 - ...s_instantiation_via_wmi_and_powershell.yml | 2 - ...on_via_wmi_and_powershell_script_block.yml | 2 - ...ote_system_discovery_with_adsisearcher.yml | 2 - .../remote_system_discovery_with_dsquery.yml | 2 - .../remote_system_discovery_with_net.yml | 2 - .../remote_system_discovery_with_wmic.yml | 2 - .../endpoint/remote_wmi_command_attempt.yml | 2 - .../endpoint/resize_shadowstorage_volume.yml | 2 - .../endpoint/revil_common_exec_parameter.yml | 2 - detections/endpoint/revil_registry_entry.yml | 2 - .../rubeus_command_line_parameters.yml | 2 - ...ticket_exports_through_winlogon_access.yml | 2 - .../runas_execution_in_commandline.yml | 2 - .../endpoint/rundll32_control_rundll_hunt.yml | 2 - ...ontrol_rundll_world_writable_directory.yml | 2 - ...ll32_create_remote_thread_to_a_process.yml | 2 - ...rundll32_createremotethread_in_browser.yml | 2 - detections/endpoint/rundll32_dnsquery.yml | 2 - .../endpoint/rundll32_lockworkstation.yml | 2 - ...undll32_process_creating_exe_dll_files.yml | 2 - .../endpoint/rundll32_shimcache_flush.yml | 2 - ...no_command_line_arguments_with_network.yml | 2 - .../rundll_loading_dll_by_ordinal.yml | 2 - .../endpoint/ryuk_test_files_detected.yml | 2 - .../endpoint/ryuk_wake_on_lan_command.yml | 2 - .../sam_database_file_access_attempt.yml | 2 - .../endpoint/samsam_test_file_write.yml | 2 - .../sc_exe_manipulating_windows_services.yml | 2 - ..._by_app_connect_and_create_adsi_object.yml | 2 - ...edule_task_with_http_command_arguments.yml | 2 - ...ule_task_with_rundll32_command_trigger.yml | 2 - ...k_creation_on_remote_endpoint_using_at.yml | 2 - ...eduled_task_deleted_or_created_via_cmd.yml | 2 - ...led_task_initiation_on_remote_endpoint.yml | 2 - .../endpoint/schtasks_run_task_on_demand.yml | 2 - ...htasks_scheduling_job_on_remote_system.yml | 2 - .../schtasks_used_for_forcing_a_reboot.yml | 2 - .../screensaver_event_trigger_execution.yml | 2 - .../endpoint/script_execution_via_wmi.yml | 2 - detections/endpoint/sdclt_uac_bypass.yml | 2 - .../sdelete_application_execution.yml | 2 - ...host_with_no_command_line_with_network.yml | 2 - .../secretdumps_offline_ntds_dumping_tool.yml | 2 - ...incipalnames_discovery_with_powershell.yml | 2 - ...ceprincipalnames_discovery_with_setspn.yml | 2 - detections/endpoint/services_escalate_exe.yml | 2 - ...ervices_lolbas_execution_process_spawn.yml | 2 - ...ution_policy_to_unrestricted_or_bypass.yml | 2 - .../endpoint/shim_database_file_creation.yml | 2 - ...nstallation_with_suspicious_parameters.yml | 2 - .../endpoint/short_lived_scheduled_task.yml | 2 - .../endpoint/short_lived_windows_accounts.yml | 2 - .../endpoint/silentcleanup_uac_bypass.yml | 2 - .../single_letter_process_on_endpoint.yml | 2 - detections/endpoint/slui_runas_elevated.yml | 2 - .../endpoint/slui_spawning_a_process.yml | 2 - detections/endpoint/spike_in_file_writes.yml | 2 - .../endpoint/spoolsv_spawning_rundll32.yml | 2 - .../spoolsv_suspicious_loaded_modules.yml | 2 - .../spoolsv_suspicious_process_access.yml | 2 - detections/endpoint/spoolsv_writing_a_dll.yml | 2 - .../spoolsv_writing_a_dll___sysmon.yml | 2 - .../endpoint/sqlite_module_in_temp_folder.yml | 2 - ...urst_correlation_dll_and_network_event.yml | 2 - ...uspicious_computer_account_name_change.yml | 2 - .../endpoint/suspicious_copy_on_system32.yml | 2 - .../suspicious_curl_network_connection.yml | 2 - ...ious_dllhost_no_command_line_arguments.yml | 2 - .../suspicious_driver_loaded_path.yml | 2 - .../suspicious_event_log_service_behavior.yml | 2 - ...ous_gpupdate_no_command_line_arguments.yml | 2 - .../suspicious_icedid_rundll32_cmdline.yml | 2 - ...cious_image_creation_in_appdata_folder.yml | 2 - ...icious_kerberos_service_ticket_request.yml | 2 - .../suspicious_linux_discovery_commands.yml | 2 - ...ous_microsoft_workflow_compiler_rename.yml | 2 - ...ious_microsoft_workflow_compiler_usage.yml | 2 - .../endpoint/suspicious_msbuild_path.yml | 2 - .../endpoint/suspicious_msbuild_rename.yml | 2 - .../endpoint/suspicious_msbuild_spawn.yml | 2 - .../suspicious_mshta_child_process.yml | 2 - .../endpoint/suspicious_mshta_spawn.yml | 2 - .../endpoint/suspicious_plistbuddy_usage.yml | 2 - ...uspicious_plistbuddy_usage_via_osquery.yml | 2 - ...ess_dns_query_known_abuse_web_services.yml | 2 - .../endpoint/suspicious_process_file_path.yml | 2 - ...picious_process_with_discord_dns_query.yml | 2 - .../endpoint/suspicious_reg_exe_process.yml | 2 - ...ious_regsvr32_register_suspicious_path.yml | 2 - .../suspicious_rundll32_dllregisterserver.yml | 2 - ...ous_rundll32_no_command_line_arguments.yml | 2 - .../suspicious_rundll32_plugininit.yml | 2 - .../endpoint/suspicious_rundll32_startw.yml | 2 - ...s_scheduled_task_from_public_directory.yml | 2 - ...protocolhost_no_command_line_arguments.yml | 2 - ...spicious_sqlite3_lsquarantine_behavior.yml | 2 - ...picious_ticket_granting_ticket_request.yml | 2 - .../suspicious_wav_file_in_appdata_folder.yml | 2 - .../endpoint/suspicious_wevtutil_usage.yml | 2 - ...spicious_writes_to_windows_recycle_bin.yml | 2 - ...svchost_lolbas_execution_process_spawn.yml | 2 - ...nfo_gathering_using_dxdiag_application.yml | 2 - ...system_information_discovery_detection.yml | 2 - ...rocesses_run_from_unexpected_locations.yml | 2 - .../system_user_discovery_with_query.yml | 2 - .../system_user_discovery_with_whoami.yml | 2 - .../time_provider_persistence_registry.yml | 2 - detections/endpoint/trickbot_named_pipe.yml | 2 - .../uac_bypass_mmc_load_unsigned_dll.yml | 2 - .../uac_bypass_with_colorui_com_object.yml | 2 - .../endpoint/uninstall_app_using_msiexec.yml | 2 - ...wn_process_using_the_kerberos_protocol.yml | 2 - .../endpoint/unload_sysmon_filter_driver.yml | 2 - .../unloading_amsi_via_reflection.yml | 2 - ..._of_computer_service_tickets_requested.yml | 2 - ..._of_kerberos_service_tickets_requested.yml | 2 - ..._remote_endpoint_authentication_events.yml | 2 - .../endpoint/unusually_long_command_line.yml | 2 - .../unusually_long_command_line___mltk.yml | 2 - ...ser_discovery_with_env_vars_powershell.yml | 2 - ..._with_env_vars_powershell_script_block.yml | 2 - detections/endpoint/usn_journal_deletion.yml | 2 - .../vbscript_execution_using_wscript_app.yml | 2 - .../endpoint/verclsid_clsid_execution.yml | 2 - detections/endpoint/w3wp_spawning_shell.yml | 2 - .../wbadmin_delete_system_backups.yml | 2 - .../wbemprox_com_object_execution.yml | 2 - ...ss_connecting_to_ip_check_web_services.yml | 2 - .../wermgr_process_create_executable_file.yml | 2 - ...cess_spawned_cmd_or_powershell_process.yml | 2 - .../wget_download_and_bash_execution.yml | 2 - ...ss_token_manipulation_sedebugprivilege.yml | 2 - ...lation_winlogon_duplicate_token_handle.yml | 2 - ...ogon_duplicate_handle_in_uncommon_path.yml | 2 - detections/endpoint/windows_adfind_exe.yml | 2 - .../windows_apache_benchmark_binary.yml | 2 - ...ws_app_layer_protocol_qakbot_namedpipe.yml | 2 - ...r_protocol_wermgr_connect_to_namedpipe.yml | 2 - ...yer_protocol_rms_radmin_tool_namedpipe.yml | 2 - ...ion_lsass_driver_registry_modification.yml | 2 - ...roxy_execution_mavinject_dll_injection.yml | 2 - ...ws_cached_domain_credentials_reg_query.yml | 2 - ...fault_file_association_for_no_file_ext.yml | 2 - ...ndows_clipboard_data_via_get_clipboard.yml | 2 - ..._hijacking_inprocserver32_modification.yml | 2 - ...ing_interpreter_hunting_path_traversal.yml | 2 - ...ipting_interpreter_path_traversal_exec.yml | 2 - ...s_command_shell_dcrat_forkbomb_payload.yml | 2 - ...dows_command_shell_fetch_env_variables.yml | 2 - ...er_account_created_by_computer_account.yml | 2 - ...ter_account_requesting_kerberos_ticket.yml | 2 - .../windows_computer_account_with_spn.yml | 2 - .../endpoint/windows_create_local_account.yml | 2 - ...credentials_from_password_stores_query.yml | 2 - ...dows_credentials_in_registry_reg_query.yml | 2 - ...ndows_curl_download_to_suspicious_path.yml | 2 - ...dows_curl_upload_to_remote_destination.yml | 2 - ...cement_modify_transcodedwallpaper_file.yml | 2 - ...dows_defender_exclusion_registry_entry.yml | 2 - ...ry_by_a_non_critical_process_file_path.yml | 2 - ...sable_change_password_through_registry.yml | 2 - ...k_workstation_feature_through_registry.yml | 2 - ...disable_logoff_button_through_registry.yml | 2 - .../windows_disable_memory_crash_dump.yml | 2 - .../windows_disable_notification_center.yml | 2 - ...sable_shutdown_button_through_registry.yml | 2 - ...group_policy_features_through_registry.yml | 2 - .../windows_disableantispyware_registry.yml | 2 - ...users_failing_to_authenticate_kerberos.yml | 2 - .../endpoint/windows_diskcryptor_usage.yml | 2 - .../windows_diskshadow_proxy_execution.yml | 2 - .../endpoint/windows_dism_remove_defender.yml | 2 - ...indows_dll_search_order_hijacking_hunt.yml | 2 - ...earch_order_hijacking_hunt_with_sysmon.yml | 2 - ...l_search_order_hijacking_with_iscsicpl.yml | 2 - .../windows_dll_side_loading_in_calc.yml | 2 - ...dll_side_loading_process_child_of_calc.yml | 2 - ...ows_dotnet_binary_in_non_standard_path.yml | 2 - .../windows_driver_load_non_standard_path.yml | 2 - .../windows_drivers_loaded_by_signature.yml | 2 - .../windows_event_for_service_disabled.yml | 2 - .../endpoint/windows_event_log_cleared.yml | 2 - ...image_file_execution_options_injection.yml | 2 - ...dows_excessive_disabled_services_event.yml | 2 - ...s_execute_arbitrary_commands_with_msdt.yml | 2 - ...er_protocol_in_non_common_process_path.yml | 2 - ...e_without_extension_in_critical_folder.yml | 2 - ..._gather_victim_host_information_camera.yml | 2 - ...indows_gather_victim_identity_sam_info.yml | 2 - ...ork_info_through_ip_check_web_services.yml | 2 - ...ter_unconstrained_delegation_discovery.yml | 2 - .../windows_hidden_schedule_task_settings.yml | 2 - ...notification_features_through_registry.yml | 2 - .../windows_high_file_deletion_frequency.yml | 2 - ...k_execution_flow_version_dll_side_load.yml | 2 - ...hunting_system_account_targeting_lsass.yml | 2 - .../windows_identify_protocol_handlers.yml | 2 - ...impair_defense_add_xml_applocker_rules.yml | 2 - ...fense_delete_win_defender_context_menu.yml | 2 - ...e_delete_win_defender_profile_registry.yml | 2 - ..._deny_security_software_with_applocker.yml | 2 - ...nses_disable_win_defender_auto_logging.yml | 2 - ...ndirect_command_execution_via_forfiles.yml | 2 - ..._indirect_command_execution_via_pcalua.yml | 2 - ...mmand_execution_via_series_of_forfiles.yml | 2 - .../windows_information_discovery_fsutil.yml | 2 - ...s_ingress_tool_transfer_using_explorer.yml | 2 - ..._input_capture_using_credential_ui_dll.yml | 2 - .../windows_installutil_credential_theft.yml | 2 - ...ndows_installutil_in_non_standard_path.yml | 2 - ..._installutil_remote_network_connection.yml | 2 - .../windows_installutil_uninstall_option.yml | 2 - ...tallutil_uninstall_option_with_network.yml | 2 - ...indows_installutil_url_in_command_line.yml | 2 - ...ers_failed_authentication_via_kerberos.yml | 2 - .../windows_iso_lnk_file_creation.yml | 2 - .../endpoint/windows_java_spawning_shells.yml | 2 - ...indows_kerberos_local_successful_logon.yml | 2 - .../windows_krbrelayup_service_creation.yml | 2 - ...dows_linked_policies_in_adsi_discovery.yml | 2 - ...il_protocol_in_non_common_process_path.yml | 2 - ...masquerading_explorer_as_child_process.yml | 2 - .../windows_mimikatz_binary_execution.yml | 2 - ...y_registry_disable_toast_notifications.yml | 2 - ...y_disable_win_defender_raw_write_notif.yml | 2 - ..._disable_windows_security_center_notif.yml | 2 - ...modify_registry_disabling_wer_settings.yml | 2 - ...s_modify_registry_disallow_windows_app.yml | 2 - ...y_registry_qakbot_binary_data_registry.yml | 2 - .../windows_modify_registry_reg_restore.yml | 2 - ...ify_registry_regedit_silent_reg_import.yml | 2 - ...y_registry_suppress_win_defender_notif.yml | 2 - ...w_compress_color_and_info_tip_registry.yml | 2 - ..._mof_event_triggered_execution_via_wmi.yml | 2 - ...change_management_mailbox_cmdlet_usage.yml | 2 - .../windows_mshta_execution_in_registry.yml | 2 - .../windows_msiexec_dllregisterserver.yml | 2 - .../windows_msiexec_remote_download.yml | 2 - ...indows_msiexec_spawn_discovery_command.yml | 2 - ...s_msiexec_unregister_dllregisterserver.yml | 2 - ...ndows_msiexec_with_network_connections.yml | 2 - ...dows_multi_hop_proxy_tor_website_query.yml | 2 - .../windows_ngrok_reverse_proxy_usage.yml | 2 - .../endpoint/windows_nirsoft_advancedrun.yml | 2 - .../endpoint/windows_nirsoft_utilities.yml | 2 - ...ows_non_system_account_targeting_lsass.yml | 2 - .../endpoint/windows_odbcconf_hunting.yml | 2 - .../endpoint/windows_odbcconf_load_dll.yml | 2 - .../windows_odbcconf_load_response_file.yml | 2 - .../windows_office_product_spawning_msdt.yml | 2 - .../windows_password_managers_discovery.yml | 2 - ...dows_phishing_recent_iso_exec_registry.yml | 2 - .../windows_possible_credential_dumping.yml | 2 - ...ows_powershell_import_applocker_policy.yml | 2 - ...rview_constrained_delegation_discovery.yml | 2 - ...erview_kerberos_service_ticket_request.yml | 2 - .../windows_powerview_spn_discovery.yml | 2 - ...iew_unconstrained_delegation_discovery.yml | 2 - .../windows_private_keys_discovery.yml | 2 - ...s_injection_of_wermgr_to_known_browser.yml | 2 - ...indows_process_injection_remote_thread.yml | 2 - ...process_injection_wermgr_child_process.yml | 2 - ...cess_injection_with_public_source_path.yml | 2 - ...ows_process_with_namedpipe_commandline.yml | 2 - ...ocesses_killed_by_industroyer2_malware.yml | 2 - .../windows_protocol_tunneling_with_plink.yml | 2 - .../windows_query_registry_reg_save.yml | 2 - ...indows_raccine_scheduled_task_deletion.yml | 2 - .../windows_rasautou_dll_execution.yml | 2 - ...ws_raw_access_to_disk_volume_partition.yml | 2 - ...raw_access_to_master_boot_record_drive.yml | 2 - .../windows_registry_certificate_added.yml | 2 - .../windows_registry_delete_task_sd.yml | 2 - ...modification_for_safe_mode_persistence.yml | 2 - .../windows_regsvr32_renamed_binary.yml | 2 - ...remote_access_software_brc4_loaded_dll.yml | 2 - .../windows_remote_access_software_hunt.yml | 2 - ...ws_remote_access_software_rms_registry.yml | 2 - ...ows_remote_assistance_spawning_process.yml | 2 - ...remote_service_rdpwinst_tool_execution.yml | 2 - ..._remote_services_allow_rdp_in_firewall.yml | 2 - ...emote_services_allow_remote_assistance.yml | 2 - .../windows_remote_services_rdp_enable.yml | 2 - ..._root_domain_linked_policies_discovery.yml | 2 - .../windows_schtasks_create_run_as_system.yml | 2 - ...ndows_security_account_manager_stopped.yml | 2 - ...ws_security_support_provider_reg_query.yml | 2 - ...dows_service_create_kernel_mode_driver.yml | 2 - ...e_created_with_suspicious_service_path.yml | 2 - ...ows_service_created_within_public_path.yml | 2 - ...ws_service_creation_on_remote_endpoint.yml | 2 - ..._service_creation_using_registry_entry.yml | 2 - .../windows_service_deletion_in_registry.yml | 2 - ..._service_initiation_on_remote_endpoint.yml | 2 - .../windows_service_stop_by_deletion.yml | 2 - ...rvice_stop_via_net__and_sc_application.yml | 2 - ..._steal_or_forge_kerberos_tickets_klist.yml | 2 - ...execution_compiled_html_file_decompile.yml | 2 - ...s_system_discovery_using_ldap_nslookup.yml | 2 - ...windows_system_discovery_using_qwinsta.yml | 2 - .../endpoint/windows_system_file_on_disk.yml | 2 - .../windows_system_logoff_commandline.yml | 2 - ...m_network_config_discovery_display_dns.yml | 2 - ...em_network_connections_discovery_netsh.yml | 2 - .../windows_system_reboot_commandline.yml | 2 - ...oxy_execution_syncappvpublishingserver.yml | 2 - .../windows_system_shutdown_commandline.yml | 2 - ...dows_system_time_discovery_w32tm_delay.yml | 2 - ...indows_system_user_discovery_via_quser.yml | 2 - .../windows_terminating_lsass_process.yml | 2 - ...uthenticate_using_explicit_credentials.yml | 2 - ...id_account_with_never_expires_password.yml | 2 - .../windows_wmi_impersonate_token.yml | 2 - .../windows_wmi_process_and_service_list.yml | 2 - .../windows_wmi_process_call_create.yml | 2 - ..._scheduled_task_created_to_spawn_shell.yml | 2 - ...eduled_task_created_within_public_path.yml | 2 - ...ws_task_scheduler_event_action_started.yml | 2 - .../endpoint/winhlp32_spawning_a_process.yml | 2 - .../endpoint/winrm_spawning_a_process.yml | 2 - detections/endpoint/winword_spawning_cmd.yml | 2 - .../endpoint/winword_spawning_powershell.yml | 2 - .../winword_spawning_windows_script_host.yml | 2 - .../wmi_permanent_event_subscription.yml | 2 - ..._permanent_event_subscription___sysmon.yml | 2 - .../wmi_recon_running_process_or_services.yml | 2 - .../wmi_temporary_event_subscription.yml | 2 - detections/endpoint/wmic_group_discovery.yml | 2 - ...wmic_noninteractive_app_uninstallation.yml | 2 - .../endpoint/wmic_xsl_execution_via_url.yml | 2 - ...miprsve_lolbas_execution_process_spawn.yml | 2 - ...pt_or_cscript_suspicious_child_process.yml | 2 - ...rovhost_lolbas_execution_process_spawn.yml | 2 - detections/endpoint/wsreset_uac_bypass.yml | 2 - detections/endpoint/xmrig_driver_loaded.yml | 2 - .../xsl_script_execution_with_wmic.yml | 2 - detections/network/detect_arp_poisoning.yml | 2 - ...domains_using_pretrained_model_in_dsdl.yml | 2 - ...connecting_to_dynamic_domain_providers.yml | 2 - ...ct_ipv6_network_infrastructure_threats.yml | 2 - .../detect_large_outbound_icmp_packets.yml | 2 - .../network/detect_outbound_ldap_traffic.yml | 2 - .../network/detect_outbound_smb_traffic.yml | 2 - .../detect_port_security_violation.yml | 2 - .../network/detect_rogue_dhcp_server.yml | 2 - .../detect_snicat_sni_exfiltration.yml | 2 - ...ct_software_download_to_network_device.yml | 2 - .../network/detect_traffic_mirroring.yml | 2 - ...ect_unauthorized_assets_by_mac_address.yml | 2 - ...t_windows_dns_sigred_via_splunk_stream.yml | 2 - .../detect_windows_dns_sigred_via_zeek.yml | 2 - .../network/detect_zerologon_via_zeek.yml | 2 - .../dns_query_length_outliers___mltk.yml | 2 - ...ry_length_with_high_standard_deviation.yml | 2 - detections/network/excessive_dns_failures.yml | 2 - ...ntrol_rest_vulnerability_cve_2022_1388.yml | 2 - ...e_of_network_traffic_from_email_server.yml | 2 - .../large_volume_of_dns_any_queries.yml | 2 - ...ltiple_archive_files_http_post_traffic.yml | 2 - .../ngrok_reverse_proxy_on_network.yml | 2 - .../plain_http_post_exfiltrated_data.yml | 2 - .../prohibited_network_traffic_allowed.yml | 2 - .../network/protocol_or_port_mismatch.yml | 2 - ...ls_passing_authentication_in_cleartext.yml | 2 - .../remote_desktop_network_bruteforce.yml | 2 - .../remote_desktop_network_traffic.yml | 2 - detections/network/smb_traffic_spike.yml | 2 - .../network/smb_traffic_spike___mltk.yml | 2 - ...splunk_identified_ssl_tls_certificates.yml | 2 - .../ssl_certificates_with_punycode.yml | 2 - detections/network/tor_traffic.yml | 2 - .../unusually_long_content_type_length.yml | 2 - .../zeek_x509_certificate_with_punycode.yml | 2 - ...d_remote_code_execution_cve_2022_26134.yml | 2 - ..._scanning_for_vulnerable_jboss_servers.yml | 2 - .../web/detect_f5_tmui_rce_cve_2020_5902.yml | 2 - ...ious_requests_to_exploit_jboss_servers.yml | 2 - ...ng_application_via_apache_commons_text.yml | 2 - .../web/fortinet_appliance_auth_bypass.yml | 2 - ...g4shell_jndi_payload_injection_attempt.yml | 2 - ...oad_injection_with_outbound_connection.yml | 2 - .../monitor_web_traffic_for_brand_abuse.yml | 2 - ...yshell_proxynotshell_behavior_detected.yml | 2 - .../web/spring4shell_payload_url_request.yml | 2 - .../web/sql_injection_with_long_urls.yml | 2 - detections/web/supernova_webshell.yml | 2 - ...re_server_side_template_injection_hunt.yml | 2 - ...emarker_server_side_template_injection.yml | 2 - detections/web/web_jsp_request_via_url.yml | 2 - ...spring4shell_http_request_class_module.yml | 2 - ...b_spring_cloud_function_functionrouter.yml | 2 - ...ndows_exchange_autodiscover_ssrf_abuse.yml | 2 - 1114 files changed, 2337 deletions(-) delete mode 100644 detections/endpoint/hunting_for_log4shell.yml diff --git a/detections/application/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml index 11080a19eb..c73bb7b928 100644 --- a/detections/application/detect_new_login_attempts_to_routers.yml +++ b/detections/application/detect_new_login_attempts_to_routers.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml index e339b5d76c..1d1d0b7240 100644 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -36,11 +36,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Web Server - atomic_guid: [] confidence: 40 cve: - CVE-2022-32154 - drilldown_search: [] impact: 50 message: A potentially risky Splunk command has been run by $user$, kindly review. mitre_attack_id: diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index 943ca47dfb..c3db58cd8f 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -36,9 +36,7 @@ tags: - 'Emotet Malware DHS Report TA18-201A ' - Suspicious Emails asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index c4d98b2e51..46a25f72f2 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Collection and Staging asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml index d0780ef2f1..4c17aac59e 100644 --- a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -39,9 +39,7 @@ tags: - Collection and Staging - HAFNIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/application/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml index f9e65b50cd..246f887724 100644 --- a/detections/application/monitor_email_for_brand_abuse.yml +++ b/detections/application/monitor_email_for_brand_abuse.yml @@ -26,9 +26,7 @@ tags: - Brand Monitoring - Suspicious Emails asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml index ba62e2f369..0b750b39a8 100644 --- a/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml +++ b/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: Multple user accounts have failed to authenticate from a single IP. mitre_attack_id: diff --git a/detections/application/no_windows_updates_in_a_time_frame.yml b/detections/application/no_windows_updates_in_a_time_frame.yml index 93d8532353..1a0aeafdb7 100644 --- a/detections/application/no_windows_updates_in_a_time_frame.yml +++ b/detections/application/no_windows_updates_in_a_time_frame.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Monitor for Updates asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/application/okta_account_locked_out.yml b/detections/application/okta_account_locked_out.yml index 736e814946..c47c8bd706 100644 --- a/detections/application/okta_account_locked_out.yml +++ b/detections/application/okta_account_locked_out.yml @@ -24,9 +24,7 @@ tags: - Suspicious Okta Activity - Okta MFA Exhaustion asset_type: Infrastructure - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: $src_user$ account has been locked out. mitre_attack_id: diff --git a/detections/application/okta_account_lockout_events.yml b/detections/application/okta_account_lockout_events.yml index 672db1613b..d6e4546227 100644 --- a/detections/application/okta_account_lockout_events.yml +++ b/detections/application/okta_account_lockout_events.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The following user $src_user$ has locked out their account within Okta. mitre_attack_id: diff --git a/detections/application/okta_failed_sso_attempts.yml b/detections/application/okta_failed_sso_attempts.yml index 102c26d924..29efda9f82 100644 --- a/detections/application/okta_failed_sso_attempts.yml +++ b/detections/application/okta_failed_sso_attempts.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 40 message: $src_user$ failed SSO authentication to the app. mitre_attack_id: diff --git a/detections/application/okta_mfa_exhaustion_hunt.yml b/detections/application/okta_mfa_exhaustion_hunt.yml index 27fa580405..83c6daf17e 100644 --- a/detections/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/application/okta_mfa_exhaustion_hunt.yml @@ -37,9 +37,7 @@ tags: - Suspicious Okta Activity - Okta MFA Exhaustion asset_type: Infrastructure - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: $src_user$ account has rejected multiple Okta pushes. mitre_attack_id: diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index 2217968ba4..d20a5d994c 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: $src_user$ has created a new API token within Okta. mitre_attack_id: diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index 71dbcb88be..4ba1e8fe95 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 40 message: $user$ has added a new device to their account. mitre_attack_id: diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index aa41441284..301ecc5fc6 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -38,9 +38,7 @@ tags: - Suspicious Okta Activity - Okta MFA Exhaustion asset_type: Infrastructure - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Risk threshold exceeded for $risk_object_type$=$risk_object$ related to Okta events. diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml index be20aacb8e..8d4f7e1776 100644 --- a/detections/application/okta_suspicious_activity_reported.yml +++ b/detections/application/okta_suspicious_activity_reported.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The following $user$ has reported a suspicious login activity. mitre_attack_id: diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml index 71a8042ce2..22a14a1cd4 100644 --- a/detections/application/okta_threatinsight_threat_detected.yml +++ b/detections/application/okta_threatinsight_threat_detected.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The following $src_ip$ has been conisidered a threat by Okta ThreatInsight. mitre_attack_id: diff --git a/detections/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/application/okta_two_or_more_rejected_okta_pushes.yml index ef2f6b7de0..592c85cfde 100644 --- a/detections/application/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/application/okta_two_or_more_rejected_okta_pushes.yml @@ -31,9 +31,7 @@ tags: - Suspicious Okta Activity - Okta MFA Exhaustion asset_type: Infrastructure - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: $src_user$ account has rejected multiple Okta pushes. mitre_attack_id: diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index ee68220cd0..80b4e26254 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Suspicious Okta Activity asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml index b48fe7b62e..377bbc10c7 100644 --- a/detections/application/path_traversal_spl_injection.yml +++ b/detections/application/path_traversal_spl_injection.yml @@ -26,11 +26,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-26889 - drilldown_search: [] impact: 50 message: Path traversal exploitation attempt from $clientip$ mitre_attack_id: diff --git a/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml index 579a0f2705..cefcf1c840 100644 --- a/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml +++ b/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml @@ -24,11 +24,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-37438 - drilldown_search: [] impact: 50 message: Potential exposure of environment variables from url embedded in dashboard mitre_attack_id: diff --git a/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml index fe8b7768e6..a293b42e58 100644 --- a/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml +++ b/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -28,11 +28,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2022-43571 - drilldown_search: [] impact: 50 message: Potential exploitation of Code Injection via Dashboard PDF generation. mitre_attack_id: diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 5cc4d0dc0b..30abfcf429 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -28,11 +28,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Web Server - atomic_guid: [] confidence: 30 cve: - CVE-2022-32154 - drilldown_search: [] impact: 90 message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed. diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index d8a11d3d37..f6c6f4c494 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -52,11 +52,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Web Server - atomic_guid: [] confidence: 40 cve: - CVE-2022-32154 - drilldown_search: [] impact: 50 message: A risky Splunk command has ran by $user$ and should be reviewed. mitre_attack_id: diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 4872d94480..6cf5a47aed 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -36,11 +36,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Web Server - atomic_guid: [] confidence: 40 cve: - CVE-2022-32154 - drilldown_search: [] impact: 50 message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). mitre_attack_id: diff --git a/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml b/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml index b886a9fad6..fe68d6290a 100644 --- a/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml +++ b/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml @@ -29,11 +29,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2022-43566 - drilldown_search: [] impact: 50 message: Potential data exfiltration attack using SID query by $user$ mitre_attack_id: diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 99bb97b616..c538c4cadc 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -34,11 +34,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2022-32153 - drilldown_search: [] impact: 50 message: $splunk_server$ may not be properly validating TLS Certificates mitre_attack_id: diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 9fca97e166..c05defd3d4 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -36,11 +36,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-32151 - drilldown_search: [] impact: 25 message: $hostname$ is not using TLS when forwarding data mitre_attack_id: diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml index f925561a7b..97437c8cda 100644 --- a/detections/application/splunk_dos_via_malformed_s2s_request.yml +++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml @@ -23,11 +23,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-3422 - drilldown_search: [] impact: 50 message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ mitre_attack_id: diff --git a/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml b/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml index d7de6f4f42..79c87dd1f4 100644 --- a/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml +++ b/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 75 cve: - CVE-2022-37439 - drilldown_search: [] impact: 100 message: Potential exposure of environment variables from url embedded in dashboard mitre_attack_id: diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 1284dc2bb3..07124a2993 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -32,11 +32,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2022-32157 - drilldown_search: [] impact: 50 message: $peer$ downloaded apps from $host$ mitre_attack_id: diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 716dc44014..95720a34c1 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -42,11 +42,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2022-32151 - drilldown_search: [] impact: 50 message: $splunk_server$ may not be properly validating TLS Certificates mitre_attack_id: diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index de10558c98..b56b9ed2c7 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -28,11 +28,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-32152 - drilldown_search: [] impact: 50 message: Splunk default issued certificate at $host$ mitre_attack_id: diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 4e6e0665b6..f3ffb82d90 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -30,11 +30,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-32152 - drilldown_search: [] impact: 50 message: Failed to validate certificate on $host$ mitre_attack_id: diff --git a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml b/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml index 6b4bbe5918..9e10a948cb 100644 --- a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml +++ b/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml @@ -26,11 +26,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2022-43567 - drilldown_search: [] impact: 90 message: Possible exploitation attempt from $clientip$ mitre_attack_id: diff --git a/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml b/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml index 39764577dd..47d357d00a 100644 --- a/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml +++ b/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2022-43568 - drilldown_search: [] impact: 50 message: Potential XSS exploitation against radio template by $user$ mitre_attack_id: diff --git a/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml b/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml index 1510a1522d..b12bab0af8 100644 --- a/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml +++ b/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml @@ -26,11 +26,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2022-43569 - drilldown_search: [] impact: 50 message: A potential XSS attempt has been detected from $user$ mitre_attack_id: diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml index 9c89639edc..679dd60476 100644 --- a/detections/application/splunk_user_enumeration_attempt.yml +++ b/detections/application/splunk_user_enumeration_attempt.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2021-33845 - drilldown_search: [] impact: 50 message: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. mitre_attack_id: diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml index a9921aa2bb..fe6e91cccb 100644 --- a/detections/application/splunk_xss_in_monitoring_console.yml +++ b/detections/application/splunk_xss_in_monitoring_console.yml @@ -24,11 +24,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2022-27183 - drilldown_search: [] impact: 50 message: A potential XSS attempt has been detected from $user$ mitre_attack_id: diff --git a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml b/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml index 495c078a29..5f52653a6d 100644 --- a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml +++ b/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2022-43561 - drilldown_search: [] impact: 50 message: Possible XSS exploitation attempt from $clientip$ mitre_attack_id: diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index be656413e3..55785f5c15 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -33,9 +33,7 @@ tags: - 'Emotet Malware DHS Report TA18-201A ' - Suspicious Emails asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/application/suspicious_java_classes.yml b/detections/application/suspicious_java_classes.yml index 5a989c07e2..1b7c1019ae 100644 --- a/detections/application/suspicious_java_classes.yml +++ b/detections/application/suspicious_java_classes.yml @@ -23,9 +23,7 @@ tags: analytic_story: - Apache Struts Vulnerability asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index 5d90be85d8..a1933034b0 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Apache Struts Vulnerability asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 5fbd3e8e23..1250f00785 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Suspicious Cloud User Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. diff --git a/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml index 348d53ad88..dc542b4911 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Suspicious Cloud Instance Activities asset_type: Cloud Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml b/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml index d0ff1e4db5..08ac7afd06 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml @@ -34,9 +34,7 @@ tags: - Cloud Cryptomining - Suspicious Cloud Instance Activities asset_type: Cloud Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index d065e05bd4..3191f86742 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious Cloud User Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following diff --git a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml index 0a2642a7e6..d018cf3df8 100644 --- a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: Amazon EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index a433e461d8..c3169abcfc 100644 --- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: Amazon EKS Kubernetes cluster Pod - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index 5cf39c4221..fba14ec32c 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -28,9 +28,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user_name$ failed to pass MFA challenge while logging into console from $src$ diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index dbb41f9469..334bc67f06 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -28,9 +28,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: User $user$ created a policy version that allows them to access any resource in their account. diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index be114db452..97914ac86a 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -27,9 +27,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index ca1b1d3af7..3592c4cf34 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -29,9 +29,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index 14c96b1a22..25ebdbc98f 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -25,9 +25,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: User $user$ has a login failure from IP $src$ mitre_attack_id: diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index ff341330f6..297932487a 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$ diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 3e2edb5ecc..c00fb86146 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -24,9 +24,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: $DB$ password has been reset from IP $sourceIPAddress$ mitre_attack_id: diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index b59e1db6b9..0b7b8d71a8 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Suspicious Cloud Authentication Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml index 607d7892f0..d827314f21 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: User $user_arn$ has delete a CloudTrail logging for account id $aws_account_id$ from IP $src$ diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 6b36a3426f..ad4cc0ce16 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$ diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml index 3366f5f37e..28b6af5eba 100644 --- a/detections/cloud/aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -30,9 +30,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user_arn$ has made potentially risky api calls $eventName$ that could impair AWS security services for account id $aws_account_id$ diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml index eae692d331..71457593f8 100644 --- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml +++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml @@ -29,9 +29,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 50 message: User $user_arn$ has created a new rule to on an S3 bucket $bucket_name$ with short expiration days diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index ef5716157f..244167a460 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: User $user_arn$ has stopped Cloudtrail logging for account id $aws_account_id$ from IP $src$ diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index ce3e642887..25cd045eb3 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -27,9 +27,7 @@ tags: analytic_story: - AWS Defense Evasion asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: User $user_arn$ has updated a cloudtrail logging for account id $aws_account_id$ from IP $src$ diff --git a/detections/cloud/aws_detect_attach_to_role_policy.yml b/detections/cloud/aws_detect_attach_to_role_policy.yml index b775aeef70..cdd9e43a17 100644 --- a/detections/cloud/aws_detect_attach_to_role_policy.yml +++ b/detections/cloud/aws_detect_attach_to_role_policy.yml @@ -23,9 +23,7 @@ tags: analytic_story: - AWS Cross Account Activity asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_detect_permanent_key_creation.yml b/detections/cloud/aws_detect_permanent_key_creation.yml index 69fdcf8a1e..3f0679482a 100644 --- a/detections/cloud/aws_detect_permanent_key_creation.yml +++ b/detections/cloud/aws_detect_permanent_key_creation.yml @@ -22,9 +22,7 @@ tags: analytic_story: - AWS Cross Account Activity asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_detect_role_creation.yml b/detections/cloud/aws_detect_role_creation.yml index 37bce96aee..af679ef5c3 100644 --- a/detections/cloud/aws_detect_role_creation.yml +++ b/detections/cloud/aws_detect_role_creation.yml @@ -25,9 +25,7 @@ tags: analytic_story: - AWS Cross Account Activity asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/cloud/aws_detect_sts_assume_role_abuse.yml index 53b3c2b095..7556fb70db 100644 --- a/detections/cloud/aws_detect_sts_assume_role_abuse.yml +++ b/detections/cloud/aws_detect_sts_assume_role_abuse.yml @@ -23,9 +23,7 @@ tags: analytic_story: - AWS Cross Account Activity asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_detect_sts_get_session_token_abuse.yml b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml index a69f19d21a..d164a10db1 100644 --- a/detections/cloud/aws_detect_sts_get_session_token_abuse.yml +++ b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml @@ -23,9 +23,7 @@ tags: analytic_story: - AWS Cross Account Activity asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index ad4d33c7a8..3843437b0d 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Ransomware Cloud asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 680f32acb4..aad4b89d52 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Ransomware Cloud asset_type: S3 Bucket - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index 0f8feaab4a..bc78ceab1c 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index c1934f92d3..8e6d292315 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 10 message: Vulnerabilities with severity high found in repository $repositoryName$ mitre_attack_id: diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 2c5703671d..d789244c64 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 1e2a54e2f6..c42135e882 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Container uploaded outside business hours from $user$ mitre_attack_id: diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 2bb18276c6..f26f8a85f2 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Container uploaded from unknown user $user$ mitre_attack_id: diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 5328baede7..4652123a25 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -23,9 +23,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Account - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index a60b272d0a..3790e5dc49 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Suspicious Cloud User Activities asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 89988243d3..da4c9adf0e 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -32,9 +32,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 998475886d..eccdf92c8d 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -30,9 +30,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index ef5db03efb..954128e3b1 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -30,9 +30,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 6a40742546..7def5713ff 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -28,9 +28,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml index 10913058b5..b3312b2a65 100644 --- a/detections/cloud/aws_lambda_updatefunctioncode.yml +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Suspicious Cloud User Activities asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml index ff2d191b88..f3bc0b36b6 100644 --- a/detections/cloud/aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$ diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index 12186f5015..66966ef36a 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -33,9 +33,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time. diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 253eb0b8fe..2506b6233b 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -26,9 +26,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$ diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index 3b2ae3566a..7dd64c04cb 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -29,9 +29,7 @@ tags: analytic_story: - AWS Network ACL Activity asset_type: AWS Instance - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 21c66ea5ae..9c2fb5596d 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -25,9 +25,7 @@ tags: analytic_story: - AWS Network ACL Activity asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 43e04ef956..ce6a4ba087 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Cloud Federated Credential Abuse asset_type: AWS Federated Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 65e51bc107..0cc6dcd0ff 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Cloud Federated Credential Abuse asset_type: AWS Federated Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index a6ff0fd793..07eaa9eca5 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -28,9 +28,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml index 0523da552a..4a5d409808 100644 --- a/detections/cloud/aws_successful_single_factor_authentication.yml +++ b/detections/cloud/aws_successful_single_factor_authentication.yml @@ -27,9 +27,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$ diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 849cd30a99..d548fd5520 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -36,9 +36,7 @@ tags: analytic_story: - AWS Identity and Access Management Account Takeover asset_type: AWS Account - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$ diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index af45f0d979..7d2f67e5c3 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -27,9 +27,7 @@ tags: analytic_story: - AWS IAM Privilege Escalation asset_type: AWS Account - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index 7140e21239..0192a0d89b 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 7ef2a6c53c..f6190cb4a0 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: User $body.properties.userPrincipalName$ failed to pass MFA challenge mitre_attack_id: diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 320b69d7f8..dd6a1bd9ec 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: External Guest User $userPrincipalName$ initiated by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index 1bba75306d..376460c01f 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: Global Administrator Role assigned for User $userPrincipalName$ initiated by $initiatedBy$ diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 663fca9b9a..320c2fcbfe 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 8ba7cb7f49..fa8c1e3c0e 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 00a634e3e7..ea02c353ee 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes. diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml index 1d42e490a9..ca00085516 100644 --- a/detections/cloud/azure_ad_new_custom_domain_added.yml +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -41,9 +41,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: A new custom domain, $domain$ , was added by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index d9e3a4d606..a42a682b87 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A new federated domain, $domain$ , was added by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index 699e113996..43b15fd9d1 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A privileged Azure AD role was assigned for User $userPrincipalName$ initiated by $initiatedBy$ diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index d8dc1dec38..d719b46cb3 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Service Principal named $displayName$ created by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index cc2af2fb45..f39a3c8fa1 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index a22379f13b..319ed21cf5 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: A new owner was added for service principal $displayName$ by $initiatedBy$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 242322bb33..2e3dbbbacb 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell. diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 412caa55de..ccee93fa28 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Successful authentication for user $body.properties.userPrincipalName$ without MFA diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 19ae204b39..68ed8ce149 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Azure Active Directory Account Takeover asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$ mitre_attack_id: diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 43b08d4371..3e2262f3fc 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: A user account, $displayName$, was enabled and its password reset within 2 minutes by $initiatedBy$ diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index c15407e64c..e43001876c 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure Active Directory - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: The SourceAnchor or ImmutableID attribute has been modified for user $userPrincipalName$ by $initiatedBy$ diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml index c922b8a398..391533b936 100644 --- a/detections/cloud/azure_automation_account_created.yml +++ b/detections/cloud/azure_automation_account_created.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A new Azure Automation account $object$ was created by $caller$ mitre_attack_id: diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 57a1380990..dfaa1c0867 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A new Azure Automation Runbook $object$ was created by $caller$ mitre_attack_id: diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml index ea2493af18..7d8cb6e0d7 100644 --- a/detections/cloud/azure_runbook_webhook_created.yml +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Azure Active Directory Persistence asset_type: Azure - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A new Azure Runbook Webhook $object$ was created by $caller$ mitre_attack_id: diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 3ef1482b3e..c6cb598124 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: CircleCI - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$ diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index 8f15849285..43229789dc 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: CircleCI - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: disable security step $mandatory_step$ in job $job_name$ from user $user$ mitre_attack_id: diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 0b462cd0bd..c24dc6ac5d 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Suspicious Cloud User Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 559a637f21..d921d52136 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Cloud Cryptomining asset_type: Cloud Compute Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: User $user$ is creating a new instance $dest$ for the first time mitre_attack_id: diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 0aec4dca51..9ef771f70c 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Cloud Cryptomining asset_type: Cloud Compute Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is creating an instance $dest$ in a new region for the first time diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index e4e21adbe5..dcc8d403a2 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Cloud Cryptomining asset_type: Cloud Compute Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: User $user$ is creating an instance $dest$ with an image that has not been previously seen. diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index d02a83bc70..c8144b66a5 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Cloud Cryptomining asset_type: Cloud Compute Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 39f312323f..7141ea4f5e 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious Cloud Instance Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is modifying an instance $dest$ for the first time. mitre_attack_id: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index d5d3dfe9e4..39a60de930 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -44,9 +44,7 @@ tags: analytic_story: - Suspicious Cloud Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index 5a2857d967..a1befd4781 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -44,9 +44,7 @@ tags: analytic_story: - Suspicious Cloud Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index 452d6d1e45..f2fff51a23 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Suspicious Cloud Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index 22545e16ef..29e2f55b8c 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -44,9 +44,7 @@ tags: analytic_story: - Suspicious Cloud Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index f326154ec6..716ae58cc3 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -17,9 +17,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: Correlation triggered for user $user$ mitre_attack_id: diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index d1a82aa775..6aa8756c11 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -17,9 +17,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: AWS Account - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: Correlation triggered for user $user$ mitre_attack_id: diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index e0b7ca61a8..9dc617cbd4 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -34,9 +34,7 @@ tags: - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: User $user$ is logging into the AWS console for the first time mitre_attack_id: diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 97f2997c7a..e70fb67c2d 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -40,9 +40,7 @@ tags: - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: User $user$ is logging into the AWS console from City $City$ for the first time diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 798dd4de7c..6831b8a715 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -41,9 +41,7 @@ tags: - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user$ is logging into the AWS console from Country $Country$ for the first time diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 2cc0f9741f..1508b62439 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -41,9 +41,7 @@ tags: - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover asset_type: AWS Instance - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: User $user$ is logging into the AWS console from Region $Region$ for the first time diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml index ee5dc56688..7eead32afa 100644 --- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Suspicious GCP Storage Activities asset_type: GCP Storage Bucket - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml index 038d059f36..74d71911a8 100644 --- a/detections/cloud/detect_new_open_gcp_storage_buckets.yml +++ b/detections/cloud/detect_new_open_gcp_storage_buckets.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious GCP Storage Activities asset_type: GCP Storage Bucket - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 89f37e06be..4c14417118 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 0ff54c3634..2163ebb10b 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml index bcfb7cf6a2..a5a18da881 100644 --- a/detections/cloud/detect_s3_access_from_a_new_ip.yml +++ b/detections/cloud/detect_s3_access_from_a_new_ip.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index d945a30242..52554934c4 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -24,9 +24,7 @@ tags: - Suspicious Cloud Instance Activities - Data Exfiltration asset_type: EC2 Snapshot - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index bb6f5a2b64..60855f359d 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -25,9 +25,7 @@ tags: analytic_story: - AWS Security Hub Alerts asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ observable: diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index 5c6d5b42bf..ececdc1568 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -23,9 +23,7 @@ tags: analytic_story: - AWS Security Hub Alerts asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml index 477e0d39b8..c031c211f7 100644 --- a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml +++ b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml @@ -47,9 +47,7 @@ tags: - Suspicious AWS Traffic - Command and Control asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml index 69ab202530..a368e990ca 100644 --- a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml +++ b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml index cbaaa59ffc..a464ec23c8 100644 --- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml @@ -25,9 +25,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: Google Cloud Platform tenant - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: User $user$ failed to pass MFA challenge mitre_attack_id: diff --git a/detections/cloud/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml index 3c01739eac..ffafd68325 100644 --- a/detections/cloud/gcp_detect_gcploit_framework.yml +++ b/detections/cloud/gcp_detect_gcploit_framework.yml @@ -25,9 +25,7 @@ tags: analytic_story: - GCP Cross Account Activity asset_type: GCP Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml index b815dc5fda..b98a5581d1 100644 --- a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml +++ b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -20,9 +20,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: GCP Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index 177376e254..792d6ab287 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -27,9 +27,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: GCP - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: MFA disabled for User $user$ initiated by $actor.email$ mitre_attack_id: diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index f717d3ad45..e67ecc8993 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -38,9 +38,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: Google Cloud Platform tenant - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Multiple Failed MFA requests for user $user$ mitre_attack_id: diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index b412a5f6c9..808ee0cdae 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -34,9 +34,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: Google Cloud Platform tenant - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$ diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index 2edd8c4aed..d3fb313689 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -26,9 +26,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: Google Cloud Platform tenant - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Successful authentication for user $user$ without MFA mitre_attack_id: diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index dfa14f4331..e417a7a7af 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -41,9 +41,7 @@ tags: analytic_story: - GCP Account Takeover asset_type: Google Cloud Platform tenant - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$ diff --git a/detections/cloud/gdrive_suspicious_file_sharing.yml b/detections/cloud/gdrive_suspicious_file_sharing.yml index 252976f972..5915fbcf6d 100644 --- a/detections/cloud/gdrive_suspicious_file_sharing.yml +++ b/detections/cloud/gdrive_suspicious_file_sharing.yml @@ -29,9 +29,7 @@ tags: - Spearphishing Attachments - Data Exfiltration asset_type: GDrive - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/github_actions_disable_security_workflow.yml b/detections/cloud/github_actions_disable_security_workflow.yml index ad43ff543e..e2d4b0a105 100644 --- a/detections/cloud/github_actions_disable_security_workflow.yml +++ b/detections/cloud/github_actions_disable_security_workflow.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GitHub - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: Security Workflow is disabled in branch $branch$ for repository $repository$ mitre_attack_id: diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 07d9d21f24..3a73ef29da 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GitHub - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: suspicious commit by $commit.commit.author.email$ to main branch mitre_attack_id: diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 2f365031ab..5d3a3f3472 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GitHub - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: suspicious commit by $commit.commit.author.email$ to develop branch mitre_attack_id: diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 757715aa62..4ec1f6930c 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GitHub - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 6971a0efd7..9ff9b040e7 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GitHub - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 1cac695cbf..63007eef51 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -32,9 +32,7 @@ tags: - Dev Sec Ops - Insider Threat asset_type: GSuite - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 58fc2c99a4..13489a3701 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GSuite - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index a0dcaa5090..af13852fe3 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GSuite - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index ed88ad022b..dda24537b2 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GSuite - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index 4cdcb419ad..772708a70f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -31,9 +31,7 @@ tags: - Dev Sec Ops - Insider Threat asset_type: GSuite - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: diff --git a/detections/cloud/gsuite_suspicious_calendar_invite.yml b/detections/cloud/gsuite_suspicious_calendar_invite.yml index bc671e564a..697a33eda2 100644 --- a/detections/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/cloud/gsuite_suspicious_calendar_invite.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: GSuite - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 99168d4259..5e7431829a 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: GSuite - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml index b9c04d8ae7..a464c47ada 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Office 365 Detections asset_type: Office 365 - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index 6f8c845870..ef1b7db806 100644 --- a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: Kubernetes - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 72a52b01b3..35c886a85a 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: Kubernetes - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Local File Inclusion Attack detected on $host$ mitre_attack_id: diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml index e81d9ca347..6d13ce27ce 100644 --- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: Kubernetes - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Remote File Inclusion Attack detected on $host$ mitre_attack_id: diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index f1182a0566..81245e0165 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Dev Sec Ops asset_type: Kubernetes - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Kubernetes Scanner image pulled on host $host$ mitre_attack_id: diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index b7227de481..d4449e5e76 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -26,9 +26,7 @@ tags: - Office 365 Detections - Cloud Federated Credential Abuse asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 93f9426316..4c3be624da 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -29,9 +29,7 @@ tags: - Office 365 Detections - Cloud Federated Credential Abuse asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index b0f48c0d6e..659325c412 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Office 365 Detections asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index bf197a62c4..44d655a41a 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -23,9 +23,7 @@ tags: analytic_story: - Office 365 Detections asset_type: Office 365 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user$ has executed an operation $Operation$ for this destination $dest$ diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 085ca97165..f557bf2e9f 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Office 365 Detections asset_type: Office 365 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 8f4820451d..1def8b1829 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -24,9 +24,7 @@ tags: - Office 365 Detections - Cloud Federated Credential Abuse asset_type: Office 365 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 7d868bfac3..9d5c61d214 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -28,9 +28,7 @@ tags: - Office 365 Detections - Cloud Federated Credential Abuse asset_type: Office 365 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index e4078e0679..3d0323935d 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -24,9 +24,7 @@ tags: - Office 365 Detections - Data Exfiltration asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 80 message: User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 30c24c8f93..b4908f3eeb 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -22,9 +22,7 @@ tags: - Office 365 Detections - Data Exfiltration asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 80 message: User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 8b7e36dace..171fb7fa44 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Office 365 Detections asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 80 message: User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index f78d7897e4..0b74507e0e 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -22,9 +22,7 @@ tags: - Office 365 Detections - Data Exfiltration asset_type: Office 365 - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 80 message: User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml index e91ab5bc63..ca96ed0d86 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml @@ -30,9 +30,7 @@ tags: - AWS Cryptomining - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml index 48cc34492a..a5e7d69130 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -26,9 +26,7 @@ tags: - AWS Cryptomining - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index d04ce6faf1..8971a54868 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 831dad4dbe..c1b2f5e1e0 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index ee2165ecef..bb46a9222f 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -41,9 +41,7 @@ tags: analytic_story: - AWS Suspicious Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index f2c242f074..843a0f1112 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -42,9 +42,7 @@ tags: analytic_story: - AWS Suspicious Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 9b6b83211d..b2d84302f7 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -41,9 +41,7 @@ tags: analytic_story: - AWS Suspicious Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index bfe6c71038..a6c260f861 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -41,9 +41,7 @@ tags: analytic_story: - AWS Suspicious Provisioning Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml b/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml index 40a17a8f2f..7c0d2f75af 100644 --- a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml +++ b/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: AWS EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml index d11b6d851b..1e056f3d7a 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml @@ -35,9 +35,7 @@ tags: - Host Redirection - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/detections/deprecated/cloud_network_access_control_list_deleted.yml index 886ac4fdec..468f65a166 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/detections/deprecated/cloud_network_access_control_list_deleted.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Cloud Network ACL Activity asset_type: Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml index eae28cbc77..c025c01002 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml @@ -50,9 +50,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml index c055e6b7a7..7ee0917195 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml @@ -51,9 +51,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index c274395e63..62a7472cb2 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Common Phishing Frameworks asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/detections/deprecated/detect_long_dns_txt_record_response.yml index ed8f18fc39..ef0c338768 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/detections/deprecated/detect_long_dns_txt_record_response.yml @@ -34,9 +34,7 @@ tags: - Suspicious DNS Traffic - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index 3d69da8144..16b0f85696 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Cloud Federated Credential Abuse asset_type: Windows - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/detections/deprecated/detect_new_api_calls_from_user_roles.yml index 52a200d6c3..678b201530 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/detections/deprecated/detect_new_api_calls_from_user_roles.yml @@ -31,9 +31,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index f1fe2d763e..2dc7beea7a 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Suspicious AWS Login Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/detections/deprecated/detect_spike_in_aws_api_activity.yml index 7e5a388f15..8f36dc295a 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/detections/deprecated/detect_spike_in_aws_api_activity.yml @@ -56,9 +56,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/detections/deprecated/detect_spike_in_network_acl_activity.yml index 4db5c90b0a..5549418212 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/detections/deprecated/detect_spike_in_network_acl_activity.yml @@ -40,9 +40,7 @@ tags: analytic_story: - AWS Network ACL Activity asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/detections/deprecated/detect_spike_in_security_group_activity.yml index f84b3b5076..0b6f048132 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/detections/deprecated/detect_spike_in_security_group_activity.yml @@ -41,9 +41,7 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/detections/deprecated/detect_usb_device_insertion.yml index fc47cbf2de..c8ca73fb71 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/detections/deprecated/detect_usb_device_insertion.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Data Protection asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 8f0ddb9201..a620c31d8c 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Dynamic DNS asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index bdffa00d4f..abb9ef91d4 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -50,9 +50,7 @@ tags: - Suspicious DNS Traffic - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index 1ed427340d..f61605ad51 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -26,9 +26,7 @@ tags: - Host Redirection - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml index 9a1280ef78..ed63e74f6f 100644 --- a/detections/deprecated/dns_record_changed.yml +++ b/detections/deprecated/dns_record_changed.yml @@ -38,9 +38,7 @@ tags: analytic_story: - DNS Hijacking asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml index 3a9413c02c..d9f428a15a 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -35,9 +35,7 @@ tags: - HAFNIUM Group - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml index 255f7ff281..5064600a47 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Unusual AWS EC2 Modifications asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml index 1334524764..d68b65ef5f 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml @@ -29,9 +29,7 @@ tags: - AWS Cryptomining - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml index 21628c47d6..f77f073b7d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml @@ -32,9 +32,7 @@ tags: analytic_story: - AWS Cryptomining asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml index bf6e71cecf..3ceae1c230 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -32,9 +32,7 @@ tags: analytic_story: - AWS Cryptomining asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml index 28e15092b5..55a209ecfa 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml @@ -31,9 +31,7 @@ tags: - AWS Cryptomining - Suspicious AWS EC2 Activities asset_type: AWS Instance - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml index 80efef04a2..d90e58fe3e 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml @@ -26,9 +26,7 @@ tags: - Windows File Extension and Association Abuse - Masquerading - Rename System Utilities asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml index b3c15bdc3b..3e1d551bc0 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Monitor Backup Solution asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/detections/deprecated/first_time_seen_command_line_argument.yml index 148286e182..d8481e834d 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/detections/deprecated/first_time_seen_command_line_argument.yml @@ -43,9 +43,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - Hidden Cobra Malware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml index f2d83fdbea..1a1f6f63f0 100644 --- a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -29,9 +29,7 @@ tags: analytic_story: - GCP Cross Account Activity asset_type: GCP Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 746e915ee7..ee9f4bba16 100644 --- a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -28,9 +28,7 @@ tags: analytic_story: - GCP Cross Account Activity asset_type: GCP Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/gcp_detect_oauth_token_abuse.yml b/detections/deprecated/gcp_detect_oauth_token_abuse.yml index 3830609e17..62ef3ae353 100644 --- a/detections/deprecated/gcp_detect_oauth_token_abuse.yml +++ b/detections/deprecated/gcp_detect_oauth_token_abuse.yml @@ -24,9 +24,7 @@ tags: analytic_story: - GCP Cross Account Activity asset_type: GCP Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml index 92842e2fb8..5318ee71ce 100644 --- a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml +++ b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: GCP Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/identify_new_user_accounts.yml b/detections/deprecated/identify_new_user_accounts.yml index e61814cb1e..6bc4743e37 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/detections/deprecated/identify_new_user_accounts.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Account Monitoring and Controls asset_type: Domain Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index c4b980d740..5da33950de 100644 --- a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -20,9 +20,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: AWS EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml index e45b8cb1a1..45e6ae5087 100644 --- a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: AWS EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml index 2950832457..9711883359 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: AWS EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index ff0a71fb4c..1181a72f9f 100644 --- a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: AWS EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml index 26c538d7df..74e887d548 100644 --- a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml +++ b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml index 6f48536ba6..8c76224620 100644 --- a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml index 7411f5c548..019c8d3724 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml index cc1a0fef91..f6dbdfb20b 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index 135886d93d..6868796a58 100644 --- a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml index 562c7cbc15..f2837f820a 100644 --- a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml index ef3a16080b..ecfac4a069 100644 --- a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml index e07d3d44b5..e0e09aa128 100644 --- a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Kubernetes Scanning Activity asset_type: Azure AKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index 44365da040..83356f0536 100644 --- a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: GCP GKE Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml b/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml index 4d71e49dab..dc50528556 100644 --- a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: GCP GKE Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml index 85ccadbcd2..00686e053c 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: GCP GKE Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml index e632a2ebfe..4bcd3b9c3e 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Kubernetes Sensitive Role Activity asset_type: GCP GKE EKS Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index da7a8e8cb2..6e57c102f8 100644 --- a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: GCP GKE Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index f5af8ce426..ed46fe1719 100644 --- a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -23,9 +23,7 @@ tags: analytic_story: - Kubernetes Sensitive Object Access Activity asset_type: GCP GKE Kubernetes cluster - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index e89029d0eb..56b1815073 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Brand Monitoring asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml index 825f93c21c..a02c00ba9b 100644 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ b/detections/deprecated/open_redirect_in_splunk_web.yml @@ -16,11 +16,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Splunk Server - atomic_guid: [] confidence: 50 cve: - CVE-2016-4859 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index 9fec1dd166..3b370cb38b 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -21,9 +21,7 @@ tags: analytic_story: - ColdRoot MacOS RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/processes_created_by_netsh.yml b/detections/deprecated/processes_created_by_netsh.yml index 5ac42a701a..185d236cde 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/detections/deprecated/processes_created_by_netsh.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Netsh Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/detections/deprecated/prohibited_software_on_endpoint.yml index c925668682..5345a2ab2a 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/detections/deprecated/prohibited_software_on_endpoint.yml @@ -31,9 +31,7 @@ tags: - 'Emotet Malware DHS Report TA18-201A ' - SamSam Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index 5bfee5bfd1..442610bb5d 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -28,9 +28,7 @@ tags: - Suspicious Windows Registry Activities - Windows Persistence Techniques asset_type: '' - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/detections/deprecated/remote_registry_key_modifications.yml index 13471be361..9d240e7081 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/detections/deprecated/remote_registry_key_modifications.yml @@ -27,9 +27,7 @@ tags: - Suspicious Windows Registry Activities - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml index 0a46f0ad37..175f339142 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml index 3037858afb..e3c2625711 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml @@ -22,11 +22,9 @@ tags: analytic_story: - Spectre And Meltdown Vulnerabilities asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2017-5753 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml index 6767a1a900..57d28cdaef 100644 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml @@ -23,11 +23,9 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Splunk Server - atomic_guid: [] confidence: 50 cve: - CVE-2018-11409 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/detections/deprecated/suspicious_changes_to_file_associations.yml index add0e406f3..6ae5331307 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/detections/deprecated/suspicious_changes_to_file_associations.yml @@ -32,9 +32,7 @@ tags: - Suspicious Windows Registry Activities - Windows File Extension and Association Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/suspicious_email___uba_anomaly.yml b/detections/deprecated/suspicious_email___uba_anomaly.yml index 385071c225..8fa095e0b9 100644 --- a/detections/deprecated/suspicious_email___uba_anomaly.yml +++ b/detections/deprecated/suspicious_email___uba_anomaly.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Suspicious Emails asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/suspicious_file_write.yml b/detections/deprecated/suspicious_file_write.yml index 5eac2de7ad..e5cc0f0c43 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/detections/deprecated/suspicious_file_write.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Hidden Cobra Malware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index f0c3f14064..66724d3e8f 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -34,9 +34,7 @@ tags: - Hermetic Wiper - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/detections/deprecated/suspicious_rundll32_rename.yml index 46121bc016..4837be12f1 100644 --- a/detections/deprecated/suspicious_rundll32_rename.yml +++ b/detections/deprecated/suspicious_rundll32_rename.yml @@ -35,9 +35,7 @@ tags: - Suspicious Rundll32 Activity - Masquerading - Rename System Utilities asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ mitre_attack_id: diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/detections/deprecated/suspicious_writes_to_system_volume_information.yml index 53ffa0306b..70f1ef51f5 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/detections/deprecated/suspicious_writes_to_system_volume_information.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Collection and Staging asset_type: Windows - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index f2871f3881..c70ebfd0b7 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -29,9 +29,7 @@ tags: - Unusual Processes - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index 5cbf994532..a497a95d31 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Credential Dumping asset_type: Windows - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/detections/deprecated/unsuccessful_netbackup_backups.yml index 13cca544c5..439b77ece9 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/detections/deprecated/unsuccessful_netbackup_backups.yml @@ -22,9 +22,7 @@ tags: analytic_story: - Monitor Backup Solution asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml index b71c6e467b..0eb36b5553 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/detections/deprecated/web_fraud___account_harvesting.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Web Fraud Detection asset_type: Account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml index 133cda069b..8d3673f69b 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Web Fraud Detection asset_type: account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml index 46865429ab..b7b27172e4 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Web Fraud Detection asset_type: account - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/deprecated/windows_connhost_exe_started_forcefully.yml b/detections/deprecated/windows_connhost_exe_started_forcefully.yml index 84e40ce904..49b84f30d3 100644 --- a/detections/deprecated/windows_connhost_exe_started_forcefully.yml +++ b/detections/deprecated/windows_connhost_exe_started_forcefully.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Ryuk Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/detections/deprecated/windows_hosts_file_modification.yml index 83755c1236..2b39b0d495 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/detections/deprecated/windows_hosts_file_modification.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Host Redirection asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 223fd97c55..197bfcfe7e 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: archive process $process_name$ with suspicious cmdline $process$ in host $dest$ diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 5e4bdbcc53..d02b11952f 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Credential Dumping asset_type: Windows - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 1af7968e8f..ab7b15034d 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -36,9 +36,7 @@ tags: - Trickbot - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. mitre_attack_id: diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 297b2f6d3b..4ac5298449 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -43,9 +43,7 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index b002c5ff5b..af6c5cc4f4 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -39,9 +39,7 @@ tags: analytic_story: - BlackMatter Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 17c06f8675..046c83be7a 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -38,9 +38,7 @@ tags: - CISA AA22-320A - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: exclusion command $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 807ef45a6b..80815507cd 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -28,9 +28,7 @@ tags: - Industroyer2 - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index d690484041..7b8cff15ef 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: '' mitre_attack_id: diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index f4e3ced6de..472255958f 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -40,9 +40,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 1822c51b57..ea6ee0511b 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 10 message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index abff5061d0..0863be8af0 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -33,9 +33,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: '' mitre_attack_id: diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 37aae2e6f7..30b76bda57 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -43,9 +43,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 2285bd40cd..cf15656365 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -34,9 +34,7 @@ tags: - Cobalt Strike - NOBELIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 8c3cb9d389..02a72606fc 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -38,11 +38,9 @@ tags: - Log4Shell CVE-2021-44228 - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index f814648f53..bd9e5042a1 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -36,9 +36,7 @@ tags: - HAFNIUM Group - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 726619164c..a4330ea1c1 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -33,9 +33,7 @@ tags: - Unusual Processes - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 37041a3b0f..e239e36c76 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Disabling Security Tools asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index f6f31ebc31..543533c228 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -34,9 +34,7 @@ tags: - WhisperGate - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 2ffe4bbbc6..a70c414c67 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -33,9 +33,7 @@ tags: - Windows Registry Abuse - Industroyer2 asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 208ae9967e..2ea91de853 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -40,9 +40,7 @@ tags: - BlackMatter Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index a1c212f182..a531d58a2a 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -36,9 +36,7 @@ tags: analytic_story: - SamSam Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 671a5cee45..86b2cfc9da 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -30,9 +30,7 @@ tags: analytic_story: - BlackMatter Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index ca78c961f3..f6363a1ca1 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -27,9 +27,7 @@ tags: - Ryuk Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 0d4706144f..6b906a69bc 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -39,9 +39,7 @@ tags: - BITS Jobs - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index bcf799d2ba..b7e1ee5981 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -44,9 +44,7 @@ tags: - DarkSide Ransomware - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 68267c4968..6801dab7f7 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -39,9 +39,7 @@ tags: - ProxyNotShell - CISA AA22-277A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 257c0e071b..0e519da2c5 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -38,9 +38,7 @@ tags: - DarkSide Ransomware - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 0c7abbb805..a368e41faa 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -31,9 +31,7 @@ tags: - Cloud Federated Credential Abuse - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index cb1f3daae1..cf9a447998 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -38,9 +38,7 @@ tags: - Deobfuscate-Decode Files or Information - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index a22a124917..94e557a9f9 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -35,9 +35,7 @@ tags: - Hermetic Wiper - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index d482c322bf..a8eeba87e0 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -30,9 +30,7 @@ tags: analytic_story: - BlackMatter Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: bcdedit process with commandline $process$ to force safemode boot the $dest$ mitre_attack_id: diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 993e36637e..26c7b71116 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -30,9 +30,7 @@ tags: - IcedID - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 24df7eafdd..123d4f991f 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -30,9 +30,7 @@ tags: analytic_story: - FIN7 asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Process name $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml index b8caa08252..19e8e8c9fb 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/endpoint/child_processes_of_spoolsv_exe.yml @@ -31,11 +31,9 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2018-8440 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 385618f2c3..895bc0d447 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index fd4a967a44..7844d981ff 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 5c9fb093a0..f648dcf05b 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index def59a47cd..cd1d384d15 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -42,11 +42,9 @@ tags: - ProxyNotShell - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-44228 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 995ea1c0b6..b38a565dbc 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 2476961664..59b98b4ba3 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -45,9 +45,7 @@ tags: - CISA AA22-277A - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index e4e3e0451b..7f89b4918f 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -27,9 +27,7 @@ tags: - DarkSide Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 516cbd1167..8a952c5f6a 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -45,9 +45,7 @@ tags: - Trickbot - DarkSide Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index f19d605da1..9a94918627 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -36,9 +36,7 @@ tags: - Clop Ransomware - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 04c9de75f3..3f0d02bad4 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -29,9 +29,7 @@ tags: - Ryuk Ransomware - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 8df3f255c5..764b2142b7 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index bf1a8b6849..fc0b031325 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -37,11 +37,9 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-40444 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 7d315f0fc1..1d11c63cdc 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -30,9 +30,7 @@ tags: - Azorult - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index cec7c80b7a..c8d7fbed44 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -31,9 +31,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index e5ca5d442b..b3ec694dc8 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -27,9 +27,7 @@ tags: - IcedID - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 815a1d741b..6f71a09966 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Credential Dumping asset_type: Windows - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 06ce8790bc..58612b2413 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -33,9 +33,7 @@ tags: - Credential Dumping - CISA AA22-257A asset_type: Windows - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 5d1456aca9..7b17b8fe24 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 01113991ee..a3becd61ed 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -27,9 +27,7 @@ tags: - Credential Dumping - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 102c694c95..1fed058dfb 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index cfcf98b4ec..1d462f6651 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index 7284b59996..5928ad4102 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 900dfb41d0..fbf1de1581 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -34,11 +34,9 @@ tags: - Log4Shell CVE-2021-44228 - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 04785371d6..f3ae04fcd3 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -29,9 +29,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An attempt to delete ShadowCopy was performed using PowerShell on $Computer$ by $User$. diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index a50ad3d8ba..39bb152b22 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -33,9 +33,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 1b84db00ff..98dd993e3e 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -34,9 +34,7 @@ tags: - CISA AA22-264A - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 3fa91551b8..5d1767982d 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -23,9 +23,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 41f12c09b2..4154dfbb5c 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Discovery Techniques asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 2af8d759c6..acdf9f50f5 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Discovery Techniques asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml index 2d98047d4b..e69f7b97ac 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -18,11 +18,9 @@ tags: analytic_story: - Baron Samedit CVE-2021-3156 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-3156 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index 41f75ecef9..4199ad478c 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -21,11 +21,9 @@ tags: analytic_story: - Baron Samedit CVE-2021-3156 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-3156 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index c8b622afce..44c752864b 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -18,11 +18,9 @@ tags: analytic_story: - Baron Samedit CVE-2021-3156 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-3156 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 204bfe2abd..2851269a91 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Detect Zerologon Attack asset_type: Windows - atomic_guid: [] confidence: 70 cve: - CVE-2020-1472 - drilldown_search: [] impact: 70 message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index b77e5e0636..10f76c601e 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -38,11 +38,9 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-36934 - drilldown_search: [] impact: 80 message: PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index bfb166b59e..148c26e977 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -30,9 +30,7 @@ tags: - Credential Dumping - Detect Zerologon Attack asset_type: Windows - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 9df7461a41..cb369b4c9d 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -43,9 +43,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: The following behavior was identified and typically related to PowerShell-Empire on $Computer$ by $UserID$. diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 1dc1d4f763..c503e107f8 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Account Monitoring and Controls asset_type: Windows - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Multiple accounts have been locked out. Review $dest$ and results related to $user$. diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index d31cb4673e..4452480147 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Account Monitoring and Controls asset_type: Windows - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index a324457ff5..cac935b48a 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -57,9 +57,7 @@ tags: - CISA AA22-257A - ProxyNotShell asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 378a306993..2af8a3dece 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -40,9 +40,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 6f3bb2d385..dbf69c284f 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -40,9 +40,7 @@ tags: - Living Off The Land - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 5f7e420e13..ca14247771 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -43,9 +43,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index e2ce6f2ba0..57c696b0f9 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -45,9 +45,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 81c6843943..8585ab7672 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -36,9 +36,7 @@ tags: - CISA AA22-264A - CISA AA22-320A asset_type: Windows - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index d83c6b9ff3..8ba32f2589 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -42,9 +42,7 @@ tags: - CISA AA22-264A - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $Computer$ by $UserID$. diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 6b5815fde0..d0e9944057 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -35,9 +35,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 6819ef4488..0043828400 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -33,9 +33,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 81a89a315e..9c84ff5552 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -36,9 +36,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index ab03a608ca..e06a5b7149 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -25,9 +25,7 @@ tags: - HAFNIUM Group - CISA AA22-257A asset_type: Windows - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 6d2d9b142a..97aab21b8b 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 63a69bac9d..eea25594dc 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 341a8a35da..32eb4699bb 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 0affc6d915..1e825e6dd0 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -34,9 +34,7 @@ tags: - Suspicious Zoom Child Processes - NOBELIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 09503d5aee..11febfa89c 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -40,9 +40,7 @@ tags: - Active Directory Lateral Movement - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 666b4c6e7d..d764259e92 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index b446ac660e..19382178a8 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -38,9 +38,7 @@ tags: - DarkSide Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index c1fc4c66fb..05c814a071 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -36,9 +36,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 178f2a773d..fff9f9809c 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -37,9 +37,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 37d1c4320c..f146d59a4e 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -35,9 +35,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 71a02c413b..eba3bb64d2 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -35,9 +35,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 3d3a849d12..a4aad948e9 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -37,9 +37,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 28182a962b..05d1326dd7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -35,9 +35,7 @@ tags: - Suspicious Regsvcs Regasm Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 36c4c4c8fc..50f88ea9db 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -41,9 +41,7 @@ tags: - Cobalt Strike - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 979f062c91..fff1784d9a 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Collection and Staging asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 0a421a3ab6..3d1e5e9f23 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -38,9 +38,7 @@ tags: - Active Directory Lateral Movement - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 27cfbd02be..5bd8265c41 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -36,9 +36,7 @@ tags: - DarkSide Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 961de7cd48..1a010771bb 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -33,9 +33,7 @@ tags: - Collection and Staging - CISA AA22-277A asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 85a8b0e42b..e6d0102490 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -40,9 +40,7 @@ tags: - Suspicious Rundll32 Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 04bda77055..f60edfbe3e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -38,9 +38,7 @@ tags: - Suspicious Rundll32 Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 9526afe89a..2e2f80dea9 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -40,9 +40,7 @@ tags: - Suspicious Rundll32 Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 1e848008b9..d8eaf8e08b 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -38,9 +38,7 @@ tags: - NOBELIUM Group - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Suspicious rundll32.exe inline HTA execution on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index cc6d3a6a14..610166c8b2 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -34,9 +34,7 @@ tags: - Discovery Techniques - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Possible SharpHound command-Line arguments identified on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 66bb479b96..62e0d2c351 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -44,9 +44,7 @@ tags: - Discovery Techniques - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Potential SharpHound file modifications identified on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 201381a07f..297262a97a 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -39,9 +39,7 @@ tags: - Discovery Techniques - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Potential SharpHound binary identified on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 58a510440c..30762b3446 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -29,9 +29,7 @@ tags: - Suspicious Command-Line Executions - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: cmd.exe launching script interpreters on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 7c02bb7ce9..d64fe71269 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -46,9 +46,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Possible malicious WMI Subscription created on $dest$ mitre_attack_id: diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index 8667076ec9..023ac47316 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -26,9 +26,7 @@ tags: analytic_story: - 'Emotet Malware DHS Report TA18-201A ' asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 02aaa83060..427968c1f6 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -38,9 +38,7 @@ tags: - Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Disable AMSI Through Registry mitre_attack_id: diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 5562c225d2..85d62ef952 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -37,9 +37,7 @@ tags: - IcedID - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 037ffdd32b..abe90fecb0 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -37,9 +37,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 41c66237ea..6887183b54 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -37,9 +37,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 8e5a1c21c8..dd47861523 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -37,9 +37,7 @@ tags: - IcedID - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 98284f7485..6bdf0a0062 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -38,9 +38,7 @@ tags: - Azorult - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index dcf376dc30..2c93fa402a 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -37,9 +37,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index ec1eab3db7..ad27e111bc 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -37,9 +37,7 @@ tags: - Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Disable ETW Through Registry mitre_attack_id: diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 52ad27aa99..a07a8fe9b2 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: WevtUtil.exe used to disable Event Logging on $dest mitre_attack_id: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index d193f4b737..293fe5d21e 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -37,9 +37,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 40 message: Disabled Registry Tools on $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 2a145dff39..3b7eab86d5 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -31,9 +31,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: schtask process with commandline $process$ to disable schedule task in $dest$ diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 14ebe2b6f7..a38d719d50 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -37,9 +37,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index edbb0bdb4b..25d52926f9 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -39,9 +39,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 40 message: Disabled 'Show Hidden Files' on $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index f05c70db3d..ae4ca72d1f 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -40,9 +40,7 @@ tags: - Suspicious Windows Registry Activities - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 5eb115706b..d9ea05613c 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -41,9 +41,7 @@ tags: - XMRig - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 40 message: Disabled 'Windows App Hotkeys' on $dest$ mitre_attack_id: diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index e23e567cd3..8ddeb9ea0a 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -45,9 +45,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 40 message: Windows Defender real time behavior monitoring disabled on $dest mitre_attack_id: diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index b2636ac857..7b39cebc32 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -36,9 +36,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows Smartscreen was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index 3e652b9035..0fc3810f78 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ mitre_attack_id: diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index c06481e702..bb13ae778f 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ mitre_attack_id: diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 7a8f9d3821..719c5f501b 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -37,9 +37,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows command prompt was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index a876fc5c4b..bcfb318c20 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -36,9 +36,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows Control Panel was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 122280d16f..8a4b67162e 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -38,9 +38,7 @@ tags: - IcedID - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index bce1e3d018..90b0a56af1 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows Firewall was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index d503f1053a..7b012e273e 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index 7f0c4e8168..557d2f66dc 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -30,9 +30,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index fd04ca959d..0961589f09 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -39,9 +39,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 041d57ee95..366ff1e1b8 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -32,9 +32,7 @@ tags: - Azorult - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index fa396477ee..b72768e781 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -40,9 +40,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The Windows registry was modified to disable system restore on $dest$ by $user$. diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 34bb827541..483daf18cc 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: The Windows Task Manager was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 0b9b589218..772be54baf 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 885430803e..d48ed6c4cc 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -37,9 +37,7 @@ tags: - Data Exfiltration - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index b13766e106..993a0979eb 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 1b534e3636..f6d1a8d8d0 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 25c774a153..5d0ed06e93 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 631a17dbe9..b855034604 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Domain controller discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index 59664eaa9f..b034871ab5 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Domain controller discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index f08d272073..533e73aff8 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 509103dc75..4f64da290d 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index fd13017bc9..f47d46a2c9 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -29,9 +29,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 61be3b2400..a6c0b928c2 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 392c485fd3..db5ddafcff 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -28,9 +28,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Suspicious files were downloaded with the Telegram application on $dest$ by $user$. diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index d1d2bf66fa..0982a9ffb2 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -24,9 +24,7 @@ tags: analytic_story: - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index dfca4b98ce..9cacc7de8f 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -49,9 +49,7 @@ tags: - Domain Trust Discovery - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index c51f46fe3d..c268599fed 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -33,9 +33,7 @@ tags: - CISA AA22-264A - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 95ba5e784f..939a5bad5a 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -39,9 +39,7 @@ tags: - HAFNIUM Group - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 375cc5f0d8..c3fc9d76d5 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Elevated domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 4c1d9416c6..4bd49cbf15 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Elevated group discovery using PowerView on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index ebdf6e3ece..47286ca692 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Elevated domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index b575db8a36..a7b595bd26 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -37,9 +37,7 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: RDP was moved to a non-standard port on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 3c981d16b0..01a03664d7 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -42,9 +42,7 @@ tags: - Windows Registry Abuse - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: wdigest registry $registry_path$ was modified in $dest$ mitre_attack_id: diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 5c21be76d1..b118fbc424 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -26,9 +26,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index 085637945e..cd6c053a06 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -31,9 +31,7 @@ tags: - Credential Dumping - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index dc442c21d5..8d8262011c 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -41,9 +41,7 @@ tags: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 7b83af2c2f..6f835a9f94 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -44,9 +44,7 @@ tags: - Living Off The Land - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index 1f5382b788..68ce63dde3 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 2a8af9f4e1..154b4db469 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 7568a9a5fa..d87c7e3de1 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -30,9 +30,7 @@ tags: - XMRig - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml index f3f45d6db1..c52de8a39a 100644 --- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml +++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Meterpreter asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$. diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index 022012f7ef..67d2856a35 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -29,9 +29,7 @@ tags: analytic_story: - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: High frequency file deletion activity detected on host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 63f0ea8ba3..2ab0ec3706 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 8ec78e4315..c0e5d21648 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Meterpreter asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index fb81421f62..162cd8530a 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -32,9 +32,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 3980f73df9..e6f5dc66b8 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -32,9 +32,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 9e621c4dba..b051ab0fa8 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -33,9 +33,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 9c18f28ea9..fb32811b95 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -34,9 +34,7 @@ tags: - Data Exfiltration - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 1752f2c16d..a75c462833 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -29,9 +29,7 @@ tags: - Ransomware - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Excessive Usage Of SC Service Utility mitre_attack_id: diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 81263724cd..6e6c918b36 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -32,9 +32,7 @@ tags: - AgentTesla - CISA AA22-277A asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. diff --git a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml index fdbd6197c0..5268cb8be1 100644 --- a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml +++ b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml @@ -39,9 +39,7 @@ tags: - ProxyShell - ProxyNotShell asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly. diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml index d89713587f..cf20a5a474 100644 --- a/detections/endpoint/exchange_powershell_module_usage.yml +++ b/detections/endpoint/exchange_powershell_module_usage.yml @@ -56,9 +56,7 @@ tags: - ProxyNotShell - CISA AA22-277A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 40 message: Suspicious Exchange PowerShell module usaged was identified on $dest$. mitre_attack_id: diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index c48c760dff..42198d56b9 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -39,9 +39,7 @@ tags: - Industroyer2 - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index dc84d7da5b..c3b008599c 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -52,9 +52,7 @@ tags: - IcedID - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 95766ad089..b7cb6413eb 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 0a4313e308..e2305ecb9b 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -27,9 +27,7 @@ tags: - Windows File Extension and Association Abuse - Masquerading - Rename System Utilities asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: process $process$ have double extensions in the file name is executed on $dest$ by $user$ diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index 96541fdf87..ddd64846a9 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -32,9 +32,7 @@ tags: - Credential Dumping - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 69888930c3..d91d484362 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -27,9 +27,7 @@ tags: analytic_story: - SamSam Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index ffe2b34a62..44469a3760 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -34,9 +34,7 @@ tags: - Windows Defense Evasion Tactics - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 5218be582a..c5cc05abd2 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Suspicious Zoom Child Processes asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml index 2ee7564aef..b5ba7d1744 100644 --- a/detections/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/endpoint/first_time_seen_running_windows_service.yml @@ -32,9 +32,7 @@ tags: - Orangeworm Attack Group - NOBELIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index c2dfcf3977..4eaa42e3c0 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -40,9 +40,7 @@ tags: - Windows Defense Evasion Tactics - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 01bdb06a40..7c901333c1 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Possible file data deletion on $dest$ using $process$ mitre_attack_id: diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index cdee7934a2..12780da054 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 516125f2c7..519609ab14 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: powershell process having commandline $Message$ to query domain password policy diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 4f631b980d..d7c51646b3 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 74c55ac1d4..d1aab776bf 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index d078fecdc0..3f18b0faf9 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 603876c389..7ff1b4c72e 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: powershell process having commandline $ScriptBlockText$ to query domain user password policy. diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 951003e1bc..3e80eef843 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 6f1364909a..5a4efe9f1f 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: powershell process having commandline $ScriptBlockText$ to query domain policy. diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 4dae5c2961..cb762df7ff 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 30 message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index caf91a2c2d..f0b94dd482 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 30 message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$ by user $UserID$. diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index c653751502..6e904f134f 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 6e21702972..ff2a6d9e6d 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index ef340e3708..26a19f1e3a 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 30 message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index 9377edf13d..54e12c2e1c 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 30 message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$ by user $UserID$. diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index ef39c8099f..3a837bda46 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System group discovery on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index b5f2cc6c55..5e2dd0874b 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System group discovery enumeration on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index ef02684f53..b9b7b091f3 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 0f2c585f58..8a86ded93c 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: - Active Directory Discovery - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 7c055f6b9d..a62e31a2b5 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 4254c5a76d..b64f2a96bb 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index dc35edbefb..f0e52190d7 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index 63a4085228..0c876a04f5 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index c534cfa11f..bdf6e61aa6 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml index 58d94a1184..9b65494900 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Remote system discovery with PowerView on $Computer$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 82101f33e0..9caa1c0805 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Remote system discovery using PowerView on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index 55524b99f0..a1fa5f9684 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Remote system discovery with PowerView on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 92154b16e5..c987996edb 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery with PowerView on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 057af17c60..0091ab25bf 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration using PowerView on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 9795617a03..3600f39ffd 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 74143edf48..aaeccdb41b 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -29,9 +29,7 @@ tags: - Active Directory Discovery - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration using PowerShell on $Computer$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index 88298ee2ad..4a1606cbb6 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml index b71a7469e8..b3225c4c6d 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Network Connection discovery on $Computer$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 143e1adc86..0d18f8b739 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration using WMI on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index b7b27c1e86..ffe74e2f21 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index d731f29a95..b9336e1c59 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 131c960372..3658fb4845 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index bf71c7b460..ebda3453ce 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 508c5c85a2..3cf382115e 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $ScriptBlockText$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 1a3b7cb5c5..0838e386cc 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index a2ad0208db..34fb295a44 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: - Active Directory Discovery - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration using PowerShell on $Computer$ by $UserID$ mitre_attack_id: diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 5c8fbe08ec..d7fd78426a 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7bf2081f92..8fe52495e3 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -42,9 +42,7 @@ tags: - Windows Registry Abuse - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 818b46886c..8c3924d6a1 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -30,9 +30,7 @@ tags: - Windows Persistence Techniques - Azorult asset_type: '' - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. mitre_attack_id: diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 73f61b0458..3c1933c45f 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -35,9 +35,7 @@ tags: - Information Sabotage - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index b30e3500b5..e3da3b86bb 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml deleted file mode 100644 index 1b75603edc..0000000000 --- a/detections/endpoint/hunting_for_log4shell.yml +++ /dev/null @@ -1,111 +0,0 @@ -name: Hunting for Log4Shell -id: 158b68fa-5d1a-11ec-aac8-acde48001122 -version: 1 -date: '2021-12-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: 'The following hunting query assists with quickly assessing CVE-2021-44228, - or Log4Shell, activity mapped to the Web Datamodel. This is a combination query - attempting to identify, score and dashboard. Because the Log4Shell vulnerability - requires the string to be in the logs, this will work to identify the activity anywhere - in the HTTP headers using _raw. Modify the first line to use the same pattern matching - against other log sources. Scoring is based on a simple rubric of 0-5. 5 being the - best match, and less than 5 meant to identify additional patterns that will equate - to a higher total score. \ - - The first jndi match identifies the standard pattern of `{jndi:` \ - - jndi_fastmatch is meant to identify any jndi in the logs. The score is set low and - is meant to be the "base" score used later. \ - - jndi_proto is a protocol match that identifies `jndi` and one of `ldap, ldaps, rmi, - dns, nis, iiop, corba, nds, http, https.` \ - - all_match is a very well written regex by https://gist.github.com/Schvenn that identifies - nearly all patterns of this attack behavior. \ - - env works to identify environment variables in the header, meant to capture `AWS_ACCESS_KEY_ID`, - `AWS_SECRET_ACCESS_KEY` and `env`. \ - - uri_detect is string match looking for the common uri paths currently being scanned/abused - in the wild. \ - - keywords matches on enumerated values that, like `$ctx:loginId`, that may be found - in the header used by the adversary. \ - - lookup matching is meant to catch some basic obfuscation that has been identified - using upper, lower and date. \ - - Scoring will then occur based on any findings. The base score is meant to be 2 , - created by jndi_fastmatch. Everything else is meant to increase that score. \ - - Finally, a simple table is created to show the scoring and the _raw field. Sort - based on score or columns of interest.' -data_source: [] -search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) - | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) - | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) - | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") - OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, - "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) - | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) - | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ - /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, - "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0) | addtotals fieldname=Score, - jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, - lookups | where Score > 2 | stats values(Score) by jndi, jndi_proto, env_var, uridetect, - all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`' -how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. - However, tested was performed against raw httpd access logs. Change the first line - to any dataset to pass the regex's against. -known_false_positives: It is highly possible you will find false positives, however, - the base score is set to 2 for _any_ jndi found in raw logs. tune and change as - needed, include any filtering. -references: -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449 -- https://regex101.com/r/OSrm0q/1/ -- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar -- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/ -- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c -- https://twitter.com/sasi2103/status/1469764719850442760?s=20 -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - - CISA AA22-320A - asset_type: Web Server - atomic_guid: [] - confidence: 50 - cve: - - CVE-2021-44228 - drilldown_search: [] - impact: 80 - message: Hunting for Log4Shell exploitation has occurred. - mitre_attack_id: - - T1190 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: http_method - type: Other - role: - - Other - - name: src - type: Other - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/log4shell-nginx.log - source: /var/log/nginx/access.log - sourcetype: nginx:plus:kv diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 003e3e567c..b9bd91d563 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -31,9 +31,7 @@ tags: - XMRig - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 72fa4ebcc0..727c560164 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -30,9 +30,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 7c71f62ab4..9863f9a5bd 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -24,9 +24,7 @@ tags: analytic_story: - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 3ebe4cdf6e..6354121127 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -44,9 +44,7 @@ tags: - CISA AA22-277A - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index b07525c38e..9e8b56718a 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: An interactive session was opened on a remote endpoint from $ComputerName mitre_attack_id: diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 70b8150025..c61fd0a5bf 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -25,11 +25,9 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 asset_type: Web Server - atomic_guid: [] confidence: 50 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file. diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 3a80d1d8eb..62b00ce10a 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -38,11 +38,9 @@ tags: - Spring4Shell CVE-2022-22965 - Atlassian Confluence Server and Data Center CVE-2022-26134 asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2022-22965 - drilldown_search: [] impact: 60 message: An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation. diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index cdc3ae9831..3e9c75b347 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -32,9 +32,7 @@ tags: - FIN7 - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 00a5851175..5f7b16ded8 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -34,9 +34,7 @@ tags: - Active Directory Kerberos Attacks - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Potential kerberoasting attack via service principal name requests detected on $dest$ diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 9258a2ea93..0bf7b854ef 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Kerberos Pre Authentication was Disabled for $Account_Name$ mitre_attack_id: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml index 226d775c32..30f4725506 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$ mitre_attack_id: diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml index 94e0705e3c..6a625686f7 100644 --- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml @@ -41,9 +41,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$ diff --git a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml index 383d30e31e..b176976e1f 100644 --- a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A Kerberos TGT request with RC4 encryption was requested for $Account_Name$ from $Client_Address$ diff --git a/detections/endpoint/kerberos_user_enumeration.yml b/detections/endpoint/kerberos_user_enumeration.yml index da1125950a..99c419caf0 100644 --- a/detections/endpoint/kerberos_user_enumeration.yml +++ b/detections/endpoint/kerberos_user_enumeration.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Potential Kerberos based user enumeration attack $Client_Address$ mitre_attack_id: diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 39d3e9f312..7d7155b798 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -29,9 +29,7 @@ tags: - Ransomware - BlackMatter Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Known services $Message$ terminated by a potential ransomware on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index 682c7275ce..7fd2d7b0a5 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Acidrain asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a $process_name$ deleting a SSH key in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 7ec7ca4632..a308a32fd8 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 4f131f6629..736db5e659 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A commandline $process$ that may create user account on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml index dd4ca686b2..5b16931189 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A possible crontab list command $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 5d45dad168..ef43e75e70 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index f83a1155b2..b482e812fd 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 757e32f912..aba199554b 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index f07fc41ef7..687ff64319 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: At application was executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index d2e7bca118..673ecbd461 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -30,9 +30,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index c645022dec..44653f1bb1 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index d0d58ddfe9..fd811f7e3f 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 635c6de447..b2341609bb 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml index e97f8c5537..0a47ec1e1e 100644 --- a/detections/endpoint/linux_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A commandline $process$ that may change ownership to root on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 4b7d823c42..913f40ae80 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 40 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ adding or removing content from the clipboard. diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 54806e4913..6d329a20fa 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -41,9 +41,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: A commandline $process$ with process $process_name$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 33b83d33df..530f8dad8b 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -30,9 +30,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 0a36d31bf0..edd11513f8 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index da8834b0be..0485136b24 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -28,9 +28,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 6cc3360869..a87ce3ff99 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -42,9 +42,7 @@ tags: - Data Exfiltration - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination. diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index a51ef3441f..dfa75c2594 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -32,9 +32,7 @@ tags: - Data Destruction - Industroyer2 asset_type: endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index 91d55c16ad..b4e8dc0192 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell. diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml index f14a026dcf..7969b0c578 100644 --- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml @@ -34,9 +34,7 @@ tags: - Industroyer2 - Data Destruction asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A deletion in known critical list of folder using rm command $process$ executed on $dest$ diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 51c4e38caf..3aa2d36004 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -40,9 +40,7 @@ tags: analytic_story: - AcidRain asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a $process_name$ deleting cron jobs in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index e7252a4282..732bc80dfe 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -41,9 +41,7 @@ tags: analytic_story: - AcidRain asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a $process_name$ deleting a daemon script in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 520ea43e70..a038cdf099 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -39,9 +39,7 @@ tags: analytic_story: - AcidRain asset_type: endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: a $process_name$ deleting a services in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 44a6dc152e..d0d9d929db 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Acidrain asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a $process_name$ deleting a SSL certificate in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml index 03706a3689..dfd940ca13 100644 --- a/detections/endpoint/linux_disable_services.yml +++ b/detections/endpoint/linux_disable_services.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Industroyer2 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable services on endpoint $dest$ by $user$. diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index c0d3ed6e11..f2963a69fd 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 26855df71e..2c32388605 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -34,9 +34,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A doas $process_name$ with commandline $process$ was executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index 583aa9e18c..18253a313f 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index 3e5ad3ed77..f27c96ceb6 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -32,9 +32,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: A possible crontab edit command $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index 3452394987..4568d032e0 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml index d5982c7598..67db3c3a81 100644 --- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -35,9 +35,7 @@ tags: - Linux Persistence Techniques - Linux Rootkit asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 9e059dfcec..25f3c3e7a6 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -30,9 +30,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index 29b8245451..c7f0ca04fe 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index 592ecf371d..620576fc2e 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index 2a672448cd..e8a13e6807 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -30,9 +30,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index 82fe31cc4c..174fc4a4ee 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 48a7d0f054..2aea19fe9a 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -34,9 +34,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index 53a80c523a..b176fbc5e5 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -42,9 +42,7 @@ tags: - Industroyer2 - Data Destruction asset_type: endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 100 message: a $process_name$ deleting multiple files in /boot/ folder in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 218af95bdf..9c51cd3e69 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -40,9 +40,7 @@ tags: analytic_story: - AcidRain asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a $process_name$ deleting multiple files in /etc/ folder in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index 6a3714495e..23679e2614 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -33,9 +33,7 @@ tags: - Linux Living Off The Land - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 10 - drilldown_search: [] impact: 10 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing curl or wget. diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index d4f460db05..56cc970b20 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -35,9 +35,7 @@ tags: - Linux Living Off The Land - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 40 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details. diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 271fab983e..8dcd3be08a 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Rootkit asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A commandline $process$ that may install kernel module on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml index 42ae7d4f09..330d08962e 100644 --- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Rootkit asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A commandline $process$ that may install kernel module on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 6d6953e61e..d485bc4c57 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -37,9 +37,7 @@ tags: analytic_story: - CyclopsBLink asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A commandline $process$ that may modify iptables firewall on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index ff6d30ec3c..93478c9185 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -35,11 +35,9 @@ tags: - Log4Shell CVE-2021-44228 - Spring4Shell CVE-2022-22965 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 33231357cc..8dbb8cb061 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Linux Rootkit asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumeration kernel modules. diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 9476e0f234..4cc1616082 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -34,9 +34,7 @@ tags: analytic_story: - CyclopsBLink asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: a $process_name$ with kworker commandline in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index 56498d0bcd..05a7d3d5fe 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 0e9585e56d..d3e37a8357 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 372849b6c3..639a7480b7 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index a6acc6527a..9fe1a68795 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -34,9 +34,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: a commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index de2908a0a4..fa4f5aee6f 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64. diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index adae725be5..67dd88a2e7 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 40 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 9533c83f01..654619ef46 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml index 9fae9e9212..2d40301dbc 100644 --- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml +++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml @@ -39,9 +39,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Privilege escalation and persistence behaviors have been identified on $risk_object$. diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 4608f75003..f87093db4b 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index cf38e76990..6ad91adb78 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -35,11 +35,9 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-4034 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml index bf13177fca..6ec0f9da15 100644 --- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml @@ -34,9 +34,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index db1496f2c4..0f2fa29c8c 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -34,9 +34,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index dbe5f57c28..6628c40851 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 72c403ddcc..99b769ad29 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -35,9 +35,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: A commandline $process$ that may modify at allow config file in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 05a329b5f7..80674a90c0 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -35,9 +35,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a commandline $process$ that may modify profile files in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index f0a03936d7..e29591eeff 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -33,9 +33,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A commandline $process$ that may modify cronjob file in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 0542a6b7f1..169de57023 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -32,9 +32,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 20 message: A commandline $process$ that may modify cronjob file using editor in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml index 2bdb25726f..b82b09b4e4 100644 --- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml +++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml @@ -32,9 +32,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index d89ff78be1..5c5ab657eb 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A commandline $process$ that may hijack library function on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index 26ac20f537..2f89ce226d 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -43,9 +43,7 @@ tags: - Linux Living Off The Land - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details. diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index b7e4846752..8920864b60 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 95c135d8f1..ae3b9995e5 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index e3bb025024..c99368b57e 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -30,9 +30,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 2350e42661..27ceda7a6b 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -39,9 +39,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A service file named as $file_path$ is created in systemd folder on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 6769abd58a..27c70e1025 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -37,9 +37,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A commandline $process$ that may create or start a service on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index dfc198cc3d..776ca413c9 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -37,9 +37,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: a commandline $process$ that may create or start a service on $dest mitre_attack_id: diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index baeb73cef7..a15d69af5c 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -37,9 +37,7 @@ tags: - Linux Persistence Techniques - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a commandline $process$ that may set suid or sgid on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index aa82bf9dc6..1302d97913 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -37,9 +37,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A commandline $process$ that may set suid or sgid on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml index f84823725b..a3d12ca8be 100644 --- a/detections/endpoint/linux_shred_overwrite_command.yml +++ b/detections/endpoint/linux_shred_overwrite_command.yml @@ -35,9 +35,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A possible shred overwrite command $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index c58e54f630..d4a3617fdd 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -31,9 +31,7 @@ tags: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index 8b2a7bca65..2583e793af 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ modifying SSH Authorized Keys. diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 0b16cdc995..f91e60609a 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally and download a file. diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml index 8638fdc2ca..3d00f691f5 100644 --- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -32,9 +32,7 @@ tags: - CyclopsBLink - Industroyer2 asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: a commandline $process$ that redirect stdout to dev/null in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml index 56e3ce698c..0b84ca3298 100644 --- a/detections/endpoint/linux_stop_services.yml +++ b/detections/endpoint/linux_stop_services.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Industroyer2 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to stop services on endpoint $dest$ by $user$. diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index 9dca5cdb2c..149c7b8475 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -34,9 +34,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: A commandline $process$ that execute sudo or su in $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index e7e29d2d83..0879ccc06c 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -32,9 +32,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: A file $file_name$ is created in $file_path$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 1a608b4c4d..fe2bfd3f33 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -33,9 +33,7 @@ tags: - Network Discovery - Industroyer2 asset_type: endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: A commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml index 8c26889091..26e0fa9e4f 100644 --- a/detections/endpoint/linux_visudo_utility_execution.yml +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -33,9 +33,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 40 message: A commandline $process$ executed on $dest$ mitre_attack_id: diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 448584b71c..5e655a8383 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: An increase of Living Off The Land behavior has been detected on $affected_systems$ mitre_attack_id: diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 60ab4a3c97..2c57206d99 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: dynwrapx.dll loaded by process $process_name$ on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index b59a3fb0f2..16f6992251 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index a63e53be57..d92c96bcbd 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local user discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml index b19178cd1e..0163fe27c3 100644 --- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml +++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml @@ -46,9 +46,7 @@ tags: - Log4Shell CVE-2021-44228 - CISA AA22-320A asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: Log4Shell Exploitation detected against $risk_object$. mitre_attack_id: diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 36c9591df2..4620ea669d 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -31,9 +31,7 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/endpoint/macos___re_opened_applications.yml index 14a75610a2..b3758a1f82 100644 --- a/detections/endpoint/macos___re_opened_applications.yml +++ b/detections/endpoint/macos___re_opened_applications.yml @@ -32,9 +32,7 @@ tags: analytic_story: - ColdRoot MacOS RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml index 56a24ec904..f64267df46 100644 --- a/detections/endpoint/macos_lolbin.yml +++ b/detections/endpoint/macos_lolbin.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Multiplle LOLbin are executed on host $host$ by user $user$ mitre_attack_id: diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index cef267741a..9688fabec5 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: plutil are executed on $host$ from $user$ mitre_attack_id: diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index b820fb7eb9..6cdb637549 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Data Exfiltration asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user $user$. diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 322127f936..38c531bd9e 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -48,9 +48,7 @@ tags: - Suspicious Regsvr32 Activity - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 474af6bd65..5caa163449 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Malicious Powershell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 21d4689621..5802c08528 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -49,9 +49,7 @@ tags: - Qakbot - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Powershell.exe running potentially malicious encodede commands on $dest$ mitre_attack_id: diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 7c4a64626b..4c203c7e18 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -32,9 +32,7 @@ tags: - HAFNIUM Group - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: PowerShell local execution policy bypass attempt on $dest$ mitre_attack_id: diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 1572ad5bf3..a2fae928c1 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -30,9 +30,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: Powershell.exe running with potential obfuscated arguments on $dest$ mitre_attack_id: diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 83bec35069..62a0d53dba 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -33,9 +33,7 @@ tags: - Active Directory Kerberos Attacks - CISA AA22-320A asset_type: endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index 403a6d1707..7bb8e81437 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -44,9 +44,7 @@ tags: - Active Directory Lateral Movement - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: Mmc.exe spawned a LOLBAS process on $dest$. mitre_attack_id: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 35826784bb..4b7d764fa0 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -31,9 +31,7 @@ tags: - Windows Registry Abuse - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Wallpaper modification on $dest$ mitre_attack_id: diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 382b29ec03..11b6edbb32 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -32,9 +32,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 40 message: Suspicious ACL permission modification on $dest$ mitre_attack_id: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index b193c5c1c1..316fc4ae44 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -41,9 +41,7 @@ tags: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: New print monitor added on $dest$ mitre_attack_id: diff --git a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml index 3306853ebd..174d6d1cea 100644 --- a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml +++ b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -53,9 +53,7 @@ tags: - ProxyShell - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 9d07a3ae6e..e1dc0bf946 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -31,9 +31,7 @@ tags: analytic_story: - FIN7 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 7dd7c5ef2e..ee37dc0ba0 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -32,9 +32,7 @@ tags: analytic_story: - FIN7 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index fd7a5a0c50..fb98246d50 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index bf5f46736f..aab303a08d 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -32,9 +32,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 2c9f036ff8..550a7a9983 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -30,11 +30,9 @@ tags: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-40444 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index a86afeca3b..6585a99861 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -43,11 +43,9 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-41379 - drilldown_search: [] impact: 80 message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 95b7e1fde0..daefb57675 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -29,9 +29,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: '' mitre_attack_id: diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index cc10e11f5c..2917ca4aaa 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -51,9 +51,7 @@ tags: analytic_story: - Active Directory Password Spraying asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index f4f72f6aa3..ed446f35a7 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -48,9 +48,7 @@ tags: - Active Directory Password Spraying - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index d39dd2b67e..1d391db3e3 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -49,9 +49,7 @@ tags: analytic_story: - Active Directory Password Spraying asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index 4d59784ef6..98d33743bf 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -52,9 +52,7 @@ tags: - Active Directory Password Spraying - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential password spraying attack from $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index aa93f0a616..631da9599a 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -50,9 +50,7 @@ tags: analytic_story: - Active Directory Password Spraying asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential password spraying attack on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index e480c18478..f6ba7baf43 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -34,9 +34,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local group discovery on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index f2d5992b32..3236008c9d 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 0394594e51..23ec1db91e 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -29,9 +29,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/endpoint/network_connection_discovery_with_net.yml index ff805503d1..567cf169bf 100644 --- a/detections/endpoint/network_connection_discovery_with_net.yml +++ b/detections/endpoint/network_connection_discovery_with_net.yml @@ -30,9 +30,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/network_connection_discovery_with_netstat.yml b/detections/endpoint/network_connection_discovery_with_netstat.yml index 72c5c30499..36d6dc3816 100644 --- a/detections/endpoint/network_connection_discovery_with_netstat.yml +++ b/detections/endpoint/network_connection_discovery_with_netstat.yml @@ -31,9 +31,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 5ecab80fa3..0c7d8fa286 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -34,9 +34,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 1ecbe9927e..5cf41d7952 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -35,9 +35,7 @@ tags: analytic_story: - HAFNIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ mitre_attack_id: diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 1e8414eeca..052be390b9 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -39,9 +39,7 @@ tags: - Active Directory Discovery - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Domain trust discovery execution on $dest$ mitre_attack_id: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 81abab88d4..2da3a8fca8 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -32,9 +32,7 @@ tags: - Remcos - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: a non firefox browser process $process_name$ accessing $Object_Name$ mitre_attack_id: diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index c3a13f3fde..7daf9f38c9 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -33,9 +33,7 @@ tags: - Azorult - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: a non firefox browser process $process_name$ accessing $Object_Name$ mitre_attack_id: diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 9a7e5ba207..11addd3cbb 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -42,9 +42,7 @@ tags: - Living Off The Land - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 100 message: Active Directory NTDS export on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index a4d139d92c..dc50287fb3 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -40,9 +40,7 @@ tags: - FIN7 - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: process $process_name$ drops a file $TargetFilename$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 9f376704ce..4d7df2f9dc 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -32,9 +32,7 @@ tags: - IcedID - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Office application spawning regsvr32.exe on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 1d5675e26d..ada78bd34f 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -35,9 +35,7 @@ tags: - IcedID - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Office application spawning rundll32.exe on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index b460febf05..6305f4b8b4 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Office document creating a schedule task on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 4f8d82fc87..227bb86b17 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -40,9 +40,7 @@ tags: - Azorult - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Office document executing a macro on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 73aa3501ad..f7ca04a685 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Office document spawning suspicious child process on $dest$ mitre_attack_id: diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index ae6da82c54..1d44622b9c 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -39,9 +39,7 @@ tags: - Qakbot - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index a705376059..19e0de7ba7 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index abd26f8bdc..2068400d65 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -39,9 +39,7 @@ tags: - AgentTesla - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 8d3287dfe9..667801a3f8 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -38,9 +38,7 @@ tags: - IcedID - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index c835f062b7..e527a72a80 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 03323751de..53119821ff 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -32,9 +32,7 @@ tags: - Spearphishing Attachments - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ on host $dest$. diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index 56f2a01c10..57610dde5c 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -39,9 +39,7 @@ tags: - Spearphishing Attachments - FIN7 asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 16f34eadc2..d621ea4da0 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -40,11 +40,9 @@ tags: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-40444 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index 9595687a3d..b4e4e877b3 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -39,11 +39,9 @@ tags: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-40444 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment. diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 6ac5484a06..e9aae104ce 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -37,11 +37,9 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 60 cve: - CVE-2021-44228 - drilldown_search: [] impact: 90 message: Java performed outbound connections to default ports of LDAP or RMI on $dest$ diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index de9abd627a..41a59defa9 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -31,9 +31,7 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: A suspicious file modification or replace in $file_path$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index 5b3fe8e64d..2a3d13e268 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 3c712eac76..0c19ffdd69 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ diff --git a/detections/endpoint/petitpotam_network_share_access_request.yml b/detections/endpoint/petitpotam_network_share_access_request.yml index 8d908b2833..8ac313baa6 100644 --- a/detections/endpoint/petitpotam_network_share_access_request.yml +++ b/detections/endpoint/petitpotam_network_share_access_request.yml @@ -37,11 +37,9 @@ tags: analytic_story: - PetitPotam NTLM Relay on Active Directory Certificate Services asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-36942 - drilldown_search: [] impact: 80 message: A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam. diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index 89e2c397f2..e2f96b4a4e 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -32,11 +32,9 @@ tags: - PetitPotam NTLM Relay on Active Directory Certificate Services - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-36942 - drilldown_search: [] impact: 80 message: A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam. diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 3e7ebc50be..6dce82c7b8 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -33,9 +33,7 @@ tags: analytic_story: - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: suspicious $process$ commandline run in $dest$ mitre_attack_id: diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 1fb9eae243..2941acd8a4 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 40 message: suspicious process $process_name$ contains commandline $process$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 1cdff6e43f..e23ff768eb 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -42,9 +42,7 @@ tags: - Active Directory Lateral Movement - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A PowerShell process was spawned as a child process of typically abused processes on $dest$ diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index d82c559ae5..6f5a31b8cc 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -39,9 +39,7 @@ tags: - Credential Dumping - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 30 message: Potential password in username ($user$) with Shannon entropy ($ut_shannon$) mitre_attack_id: diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index fcfb282c1f..090cf36dde 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Suspicious Command-Line Executions asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 60 message: Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$ diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 0d253d1139..7758f29ad3 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -57,9 +57,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $user$ executing suspicious commands. diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index 0465162625..59e8b43a8c 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -44,11 +44,9 @@ tags: - Log4Shell CVE-2021-44228 - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-44228 - drilldown_search: [] impact: 90 message: PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index a178153152..81f0de7d38 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A PowerShell script has been identified with InProcServer32 within the script code on $Computer$. diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 5f0a311c36..4c89aba10f 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 590920529e..b33711ccc1 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -32,9 +32,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: '' mitre_attack_id: diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index f38b9c15d7..f0db0dac55 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -38,9 +38,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 4b051f2ed6..f18e3a6293 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -28,9 +28,7 @@ tags: - Malicious PowerShell - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Powershell Enable SMB1Protocol Feature mitre_attack_id: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 63143f4648..6626ca9dcc 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -30,9 +30,7 @@ tags: - Malicious PowerShell - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 10 message: A suspicious powershell script contains COM CLSID command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 7205b3a088..7b22f15b9d 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -42,9 +42,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index bc3794729a..7720b3b366 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -40,9 +40,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index ae5888ffe3..fe00cba894 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local group discovery on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 7997981d49..7fc1d10fbe 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local group discovery on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml index ead84eccef..ef2999dcd7 100644 --- a/detections/endpoint/powershell_load_module_in_meterpreter.yml +++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml @@ -35,9 +35,7 @@ tags: analytic_story: - MetaSploit asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: PowerShell was identified running a script utilized by Meterpreter from MetaSploit on endpoint $Computer$ by user $user_id$. diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 764a4bce48..820e0dcee0 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -42,9 +42,7 @@ tags: - Malicious PowerShell - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index ed9986b0e5..8d7b85077f 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -33,9 +33,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index f46268ed91..63598d319a 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index fd4208164c..75494dffe8 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -26,9 +26,7 @@ tags: analytic_story: - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$ mitre_attack_id: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 1365dbb399..8b7ce16c73 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -35,9 +35,7 @@ tags: analytic_story: - BITS Jobs asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 51791626c9..fe26dac1b3 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -32,9 +32,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: A PowerShell script contains memorystream command in $ScriptBlockText$ as new object backstore with EventCode $EventCode$ on host $Computer$. diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 2e24d49290..824274bb6f 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -34,9 +34,7 @@ tags: - CISA AA22-320A - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: exclusion command $Message$ executed on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index cbd93c93e5..54369d5472 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index c41e42dcfa..f6cdf0b9ce 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -35,9 +35,7 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 4eac89636c..b666d1477d 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -36,12 +36,10 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - CVE-2021-1675 - drilldown_search: [] impact: 80 message: Suspicious print driver was loaded on endpoint $ComputerName$. mitre_attack_id: diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 8bd647e675..e4d4dcec87 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -34,12 +34,10 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - CVE-2021-1675 - drilldown_search: [] impact: 80 message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index eec84a959a..a966db8722 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -38,9 +38,7 @@ tags: - Qakbot - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 870edba2bb..1c4bdb8bc2 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -34,9 +34,7 @@ tags: - Remcos - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 60 message: A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 4a2dab0b19..0b9e01e54b 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 1edee16dd6..cf785dfd21 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -29,9 +29,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 0b40649def..86ecf8ff0d 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -45,9 +45,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 027537db11..dadae48e00 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -35,9 +35,7 @@ tags: - DHS Report TA18-074A - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A process $process_name$ has launched netsh with command-line $process$ on $dest$. diff --git a/detections/endpoint/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml index 63258154c1..1a6fa6a323 100644 --- a/detections/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/endpoint/processes_tapping_keyboard_events.yml @@ -27,9 +27,7 @@ tags: analytic_story: - ColdRoot MacOS RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/randomly_generated_scheduled_task_name.yml b/detections/endpoint/randomly_generated_scheduled_task_name.yml index 865b63d060..534bf56e6b 100644 --- a/detections/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/endpoint/randomly_generated_scheduled_task_name.yml @@ -34,9 +34,7 @@ tags: - Active Directory Lateral Movement - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A windows scheduled task with a suspicious task name was created on $dest$ mitre_attack_id: diff --git a/detections/endpoint/randomly_generated_windows_service_name.yml b/detections/endpoint/randomly_generated_windows_service_name.yml index 0c0da0819d..c8b6d738bb 100644 --- a/detections/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/endpoint/randomly_generated_windows_service_name.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A Windows Service with a suspicious service name was installed on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 6076ce369c..54cef289c9 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -31,9 +31,7 @@ tags: - DarkSide Ransomware - BlackMatter Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A high frequency file creation of $file_name$ in different file path in host $Computer$ diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 901637f97f..df79f32184 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -38,9 +38,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A suspicious powershell script contains AV recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 15d4c57d1a..0140538055 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -40,9 +40,7 @@ tags: - Industroyer2 - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 75 message: A suspicious powershell script contains host recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 710d786abc..448a4a7970 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Recursive Delete of Directory In Batch CMD mitre_attack_id: diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 5921d48c89..7e725e1b5e 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -32,9 +32,7 @@ tags: - Windows Persistence Techniques - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 75 message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 0fc3d0f559..60a45ecba7 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -35,9 +35,7 @@ tags: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A registry activity in $registry_path$ related to shim modication in host $dest$ diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index e8f3406d85..1b6e6224a4 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -53,9 +53,7 @@ tags: - Azorult - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 95 - drilldown_search: [] impact: 80 message: A registry activity in $registry_path$ related to persistence in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 6475a0a076..9ee114e1f8 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -44,9 +44,7 @@ tags: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 95 - drilldown_search: [] impact: 80 message: A registry activity in $registry_path$ related to privilege escalation in host $dest$ diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 94fd99d55b..410e92414f 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -37,9 +37,7 @@ tags: - Hermetic Wiper - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 838811b1e3..5c8e222429 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -39,9 +39,7 @@ tags: - Living Off The Land - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 7582b0b502..8664bd9aca 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -33,9 +33,7 @@ tags: - Remcos - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 88c3c9ed81..3c56da9d33 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: file $file_name$ created in $file_path$ of $dest$ mitre_attack_id: diff --git a/detections/endpoint/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml index a34c3ef143..a5ddf1d8b6 100644 --- a/detections/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/endpoint/remote_desktop_process_running_on_system.yml @@ -31,9 +31,7 @@ tags: - Hidden Cobra Malware - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index c7fc305e8c..f5467daa73 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 1ce2493d52..ab97135c96 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index f9fd0aea25..a32c205007 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 13f387d914..26b56e1fe2 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $Computer$ by abusing WinRM using PowerShell.exe diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 9a476b7208..c07c8ff3ae 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $dest mitre_attack_id: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index d9e9d966c4..3c6fd371f7 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -33,9 +33,7 @@ tags: - Suspicious WMI Use - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index c822bc6717..df7e6232b2 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index b3f8f94568..95a10a925c 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 90 message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index 944d4d5f58..aed077a294 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $Computer$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index ff96e5bec9..bcfe4bd611 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index a957baf923..259fc42a06 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index 471eeec03f..115be63f78 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 17a3392452..18c8fddd8d 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -32,9 +32,7 @@ tags: - Suspicious WMI Use - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A wmic.exe process $process$ contain node commandline $process$ in host $dest$ diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index f49080e4a7..580728f3e0 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index f8726c8ccc..8324f93e56 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -30,9 +30,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 837f1ef071..a975c1f082 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -38,9 +38,7 @@ tags: - Revil Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 60 message: A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 188932c7d7..225516daee 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -42,9 +42,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Rubeus command line parameters were used on $dest$ mitre_attack_id: diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 9b84d6e2be..5e39408853 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Winlogon.exe was accessed by $SourceImage$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 20c2c5abf5..5a02ae33c5 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -34,9 +34,7 @@ tags: - Windows Privilege Escalation - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: elevated process using runas on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index ff862d529f..5ea0208fb1 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -40,11 +40,9 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-40444 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 4a80eee892..48feff51ba 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -42,11 +42,9 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-40444 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 22631a1b8b..f43c13dcdd 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -27,9 +27,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 978092492b..eac02a0b31 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -28,9 +28,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index ce827be6fc..7d8d3fef8a 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -27,9 +27,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index a4834c2103..f1c66a14de 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: process $process_name$ with cmdline $process$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 9aa5424110..14e5491bfb 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -27,9 +27,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index 65513c3c3f..a55b0d02f8 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -31,9 +31,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: rundll32 process execute $process$ to clear shim cache in $dest$ mitre_attack_id: diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index b8fc708d5d..5088fd1ce3 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -43,11 +43,9 @@ tags: - Cobalt Strike - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-34527 - drilldown_search: [] impact: 70 message: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 908f626229..aefdc00fb2 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -39,9 +39,7 @@ tags: - Living Off The Land - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index e59c6e5d8e..d2431b13fd 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Ryuk Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: A creation of ryuk test file $file_path$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index b02bbd530e..11c00c5f73 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Ryuk Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A process $process_name$ with wake on LAN commandline $process$ in host $dest$ diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml index 0d18959b64..be82ab04af 100644 --- a/detections/endpoint/sam_database_file_access_attempt.yml +++ b/detections/endpoint/sam_database_file_access_attempt.yml @@ -33,11 +33,9 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-36934 - drilldown_search: [] impact: 80 message: The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 6557dd53bc..a8ad98e288 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -24,9 +24,7 @@ tags: analytic_story: - SamSam Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 60 message: A samsam ransomware test file creation in $file_path$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 87755fe24e..3fba24de60 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -32,9 +32,7 @@ tags: - NOBELIUM Group - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index 7c29e10a37..07057998b7 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -34,9 +34,7 @@ tags: analytic_story: - blackMatter ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: process $Image$ create a file $TargetFilename$ in host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 808bab7168..7194ef0fc0 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -36,9 +36,7 @@ tags: - Windows Persistence Techniques - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 82efcdeebc..907027723b 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -39,9 +39,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 4c28f31c3a..bff00167f0 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -33,9 +33,7 @@ tags: - Active Directory Lateral Movement - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A Windows Scheduled Task was created on a remote endpoint from $dest mitre_attack_id: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 7469b79384..190ccfbc1c 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -41,9 +41,7 @@ tags: - Trickbot - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 6fd9c7c5a2..2e126ac3cb 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -30,9 +30,7 @@ tags: - Active Directory Lateral Movement - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A Windows Scheduled Task was ran on a remote endpoint from $dest mitre_attack_id: diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 7938246f7f..3f34f335f3 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -32,9 +32,7 @@ tags: - CISA AA22-257A - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 7beeeef5af..56f4f09c0c 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -33,9 +33,7 @@ tags: - Living Off The Land - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A schedule task process $process_name$ with remote job command-line $process$ in host $dest$ by $user$. diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 591e07a1ba..c80213f949 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -28,9 +28,7 @@ tags: - Windows Persistence Techniques - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index d19e1730b5..dd68039f1d 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -35,9 +35,7 @@ tags: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index e22488eaa2..5429582372 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A wmic.exe process $process_name$ taht execute script in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 73dbb710ce..da4875821c 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -40,9 +40,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index f698891f6d..c99d61fd53 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Masquerading - Rename System Utilities asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: sdelete process $process_name$ executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 49c4059a94..26f15f0ba4 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 3445025d2c..05b9ca3bd1 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index 3b33ed6a85..d1c626aa22 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -53,9 +53,7 @@ tags: - Active Directory Kerberos Attacks - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $UserID$ attempting to identify service principle diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 298ce2efd7..d44c7a7b3a 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -59,9 +59,7 @@ tags: - Active Directory Discovery - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index ab60b18bd6..f4eaba769d 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 95 - drilldown_search: [] impact: 80 message: A service process $parent_process_name$ with process path $process_path$ in host $dest$ diff --git a/detections/endpoint/services_lolbas_execution_process_spawn.yml b/detections/endpoint/services_lolbas_execution_process_spawn.yml index a439f54cee..0db6c65e8f 100644 --- a/detections/endpoint/services_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_lolbas_execution_process_spawn.yml @@ -45,9 +45,7 @@ tags: - Living Off The Land - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: Services.exe spawned a LOLBAS process on $dest mitre_attack_id: diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 744bfb31a3..0e4647dfd3 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -31,9 +31,7 @@ tags: - Credential Dumping - HAFNIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index adf2e815b2..706dcbd1f1 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A process that possibly write shim database in $file_path$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 2abd49fd7f..a1604dd7cf 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A process $process_name$ that possible create a shim db silently in host $dest$ diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 9de2a0b339..444f33e6ab 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -30,9 +30,7 @@ tags: - Active Directory Lateral Movement - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index a5a1d7f749..d5c658d7d4 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -25,9 +25,7 @@ tags: analytic_story: - Account Monitoring and Controls asset_type: Windows - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A user account created or delete shortly in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 25aff7aa11..6438d34ccf 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 44e2ad609f..627e04708c 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -27,9 +27,7 @@ tags: analytic_story: - DHS Report TA18-074A asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A suspicious process $process_name$ with single letter in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index ba8ea3cb6a..1e814ed5fa 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -35,9 +35,7 @@ tags: - DarkSide Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A slui process $process_name$ with elevated commandline $process$ in host $dest$ diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index a07056425c..4bf3e0fc7a 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -33,9 +33,7 @@ tags: - DarkSide Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ diff --git a/detections/endpoint/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml index 1dc3099175..f311c2bb5f 100644 --- a/detections/endpoint/spike_in_file_writes.yml +++ b/detections/endpoint/spike_in_file_writes.yml @@ -31,9 +31,7 @@ tags: - Ryuk Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 605080b911..3477a9e6fe 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -34,11 +34,9 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - drilldown_search: [] impact: 80 message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 5302fefa2a..3b760736d8 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -25,11 +25,9 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - drilldown_search: [] impact: 80 message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index d9bbca771e..c542d07331 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -31,11 +31,9 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - drilldown_search: [] impact: 80 message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 307b67e753..1eceb9f1f9 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -36,11 +36,9 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - drilldown_search: [] impact: 80 message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index ad4f151448..9c93b09bfb 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -31,11 +31,9 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 90 cve: - CVE-2021-34527 - drilldown_search: [] impact: 80 message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index a7edf5f295..70fe2cd4c6 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -27,9 +27,7 @@ tags: analytic_story: - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml index 56defebb1e..062ea92614 100644 --- a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -27,9 +27,7 @@ tags: analytic_story: - NOBELIUM Group asset_type: Windows - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index b8344c2d40..6159c6aa4b 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -30,12 +30,10 @@ tags: analytic_story: - sAMAccountName Spoofing and Domain Controller Impersonation asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-42287 - CVE-2021-42278 - drilldown_search: [] impact: 100 message: A computer account $Old_Account_Name$ was renamed with a suspicious computer name diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 606c344e8e..d065420edc 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -34,9 +34,7 @@ tags: - Qakbot - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: execution of copy exe to copy file from $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml index 05df8fdcee..9d62ea37fe 100644 --- a/detections/endpoint/suspicious_curl_network_connection.yml +++ b/detections/endpoint/suspicious_curl_network_connection.yml @@ -30,9 +30,7 @@ tags: - Ingress Tool Transfer - Linux Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 32decb01c2..2d70413ea2 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index cf4c656b07..cb7c869920 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -34,9 +34,7 @@ tags: - CISA AA22-320A - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious driver $ImageLoaded$ on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 6d9b9dfa8a..2a03e0bdf8 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -32,9 +32,7 @@ tags: - Ransomware - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: The Windows Event Log Service shutdown on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index ae8a4e4a42..abd01d8d02 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 2e7b34af0c..25bbf4fc63 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -30,9 +30,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: rundll32 process $process_name$ with commandline $process$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index a503d34e38..652b9adc8e 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: process $process_name$ creating image file $file_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index 4f8014f343..0351fb3404 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -36,12 +36,10 @@ tags: - sAMAccountName Spoofing and Domain Controller Impersonation - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 cve: - CVE-2021-42287 - CVE-2021-42278 - drilldown_search: [] impact: 100 message: A suspicious Kerberos Service Ticket was requested by $Account_Name$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml index 28e4c5c1e8..d73d1da1a9 100644 --- a/detections/endpoint/suspicious_linux_discovery_commands.yml +++ b/detections/endpoint/suspicious_linux_discovery_commands.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Linux Post-Exploitation asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Suspicious Linux Discovery Commands detected on $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 98a5e8c8ce..17df7a09da 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -37,9 +37,7 @@ tags: - Masquerading - Rename System Utilities - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 4e74974a5a..1360e20baf 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -31,9 +31,7 @@ tags: - Trusted Developer Utilities Proxy Execution - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 0b62516359..d983aae438 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -37,9 +37,7 @@ tags: - Masquerading - Rename System Utilities - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index 5c37d94df5..df8b8e18e1 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -35,9 +35,7 @@ tags: - Masquerading - Rename System Utilities - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index c264174da8..05c7340175 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -35,9 +35,7 @@ tags: - Trusted Developer Utilities Proxy Execution MSBuild - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: Suspicious msbuild.exe process executed on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 4edc5ef456..2cf5ae41c4 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -35,9 +35,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: suspicious mshta child process detected on host $dest$ by user $user$. mitre_attack_id: diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index 6b753accd8..6f18cd4a71 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -33,9 +33,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: mshta.exe spawned by wmiprvse.exe on $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml index 299fe24086..445091a50b 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage.yml @@ -49,9 +49,7 @@ tags: analytic_story: - Silver Sparrow asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index e4b257c5fc..523bafd2b9 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -44,9 +44,7 @@ tags: analytic_story: - Silver Sparrow asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 2b1287923c..f966df4250 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -32,9 +32,7 @@ tags: - Remcos - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 11a1141389..eb1e895778 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -50,9 +50,7 @@ tags: - Azorult - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicioues process $Processes.process_path.file_path$ running from suspicious location diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 31cb9b0e26..bfa97a6536 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -29,9 +29,7 @@ tags: analytic_story: - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 68e352f8e6..bf5172b86c 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -36,9 +36,7 @@ tags: - Disabling Security Tools - DHS Report TA18-074A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 4490498a53..ee0368f393 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -42,9 +42,7 @@ tags: - Living Off The Land - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicious $Processes.process_path.file_path$ process potentially loading malicious code diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 7bb7f36497..bd42640d23 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -41,9 +41,7 @@ tags: - Suspicious Rundll32 Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: $Processes.process_path.file_path$ process potentially loading malicious code diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml index 2df759e4a4..d276c4c3d1 100644 --- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml @@ -36,11 +36,9 @@ tags: - Cobalt Strike - PrintNightmare CVE-2021-34527 asset_type: Endpoint - atomic_guid: [] confidence: 70 cve: - CVE-2021-34527 - drilldown_search: [] impact: 70 message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 792b9b6672..94740fb596 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -29,9 +29,7 @@ tags: analytic_story: - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: rundll32 process $process_name$ with commandline $process$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index c5784e0cf4..c1cec917f6 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -41,9 +41,7 @@ tags: - Cobalt Strike - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: rundll32.exe running with suspicious parameters on $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 10d903d69a..26fbc15605 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -36,9 +36,7 @@ tags: - Azorult - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicious scheduled task registered on $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 3b946dce79..4fc61825de 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Cobalt Strike asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml index adb0956433..75218548c8 100644 --- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Silver Sparrow asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml index c6083ca4e2..3f2f0aa2ed 100644 --- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml +++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml @@ -37,9 +37,7 @@ tags: - sAMAccountName Spoofing and Domain Controller Impersonation - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 100 message: A suspicious TGT was requested was requested mitre_attack_id: diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index baef88dc00..06a8be4c2b 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: process $process_name$ creating image file $file_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index e3fa0053f4..2c3b6a2a32 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -32,9 +32,7 @@ tags: - Ransomware - Clop Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ mitre_attack_id: diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 80a64bbd55..40a332f893 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Collection and Staging asset_type: Windows - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 40 message: Suspicious writes to windows Recycle Bin process $Processes.process_name$ mitre_attack_id: diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 823f298213..7465beedfa 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -43,9 +43,7 @@ tags: - Active Directory Lateral Movement - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: Svchost.exe spawned a LOLBAS process on $dest$ mitre_attack_id: diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 2c687e54e1..1501f776d6 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: dxdiag.exe process with commandline $process$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 0d85664843..0a55ea6728 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Discovery Techniques asset_type: Windows - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Potential system information discovery behavior on $dest$ by $User$ mitre_attack_id: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 0b73fa9028..e2b92d1b10 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -40,9 +40,7 @@ tags: - Masquerading - Rename System Utilities - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: A System process $process_name$ is running from $process_path$ on $dest$, potentially non-standard. diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 351b619bab..53475a63df 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index f622bca44a..3f42a1a71c 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -27,9 +27,7 @@ tags: - Active Directory Discovery - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index b2b214ecad..93804d3d75 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -42,9 +42,7 @@ tags: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index b4faf3e0be..9080c9799b 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: Possible Trickbot namedpipe created on $Computer$ by $Image$ mitre_attack_id: diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 4d85859711..89b54f263c 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 73748e213d..6a4d15342b 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 3ad216f16d..257508ece2 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: process $process_name$ with a cmdline $process$ in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index 40fc097210..095d12775b 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: '' mitre_attack_id: diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 73c0b75d0a..68699a6a1a 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Disabling Security Tools asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Possible Sysmon filter driver unloading on $dest$ mitre_attack_id: diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index 7e1f62faa4..643c1c2054 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -40,9 +40,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Possible AMSI Unloading via Reflection using PowerShell on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml index 3d3d392f26..b504ed6a48 100644 --- a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -40,9 +40,7 @@ tags: - Active Directory Lateral Movement - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: '' mitre_attack_id: diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 6981caef84..539a0419f9 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: tbd mitre_attack_id: diff --git a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index f2a8077a2d..d2a83b25bf 100644 --- a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: '' mitre_attack_id: diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 47014dce04..26fb3dc849 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -30,9 +30,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: Unusually long command line $Processes.process_name$ on $dest$ observable: diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml index f2ab326c62..c3ccec65b7 100644 --- a/detections/endpoint/unusually_long_command_line___mltk.yml +++ b/detections/endpoint/unusually_long_command_line___mltk.yml @@ -43,9 +43,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - Ransomware asset_type: '' - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 58927ab29f..fb67cda733 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index be0e885d52..b0dae3c70a 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System user discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 83098a71f1..aa4f53b3eb 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -29,9 +29,7 @@ tags: - Windows Log Manipulation - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 50 message: Possible USN journal deletion on $dest$ mitre_attack_id: diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index bf1070643f..fc609b9d2d 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -32,9 +32,7 @@ tags: - FIN7 - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Process name $process_name$ with commandline $process$ to execute vbsscript mitre_attack_id: diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 291790b6a8..a31edb58cb 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: process $process_name$ to execute possible clsid commandline $process$ in $dest$ diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 333ffabd81..0f3b1ebd33 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -43,13 +43,11 @@ tags: - ProxyNotShell - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2021-34473 - CVE-2021-34523 - CVE-2021-31207 - drilldown_search: [] impact: 70 message: Possible Web Shell execution on $dest$ mitre_attack_id: diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 3c72409f6d..7d428b78f2 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -31,9 +31,7 @@ tags: - Ransomware - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: System backups deletion on $dest$ mitre_attack_id: diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 47618eef91..2f814022d9 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -28,9 +28,7 @@ tags: - Ransomware - Revil Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: Suspicious COM Object Execution on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 31f052190b..99681a42df 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Wermgr.exe process connecting IP location web services on $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 226cb254e4..19c6028a6f 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Trickbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Wermgr.exe writing executable files on $dest$ mitre_attack_id: diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 2c6c3a3c8d..5a33d73c59 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -32,9 +32,7 @@ tags: - Trickbot - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Wermgr.exe spawning suspicious processes on $dest$ mitre_attack_id: diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index df36bddd7c..13becf7607 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -34,11 +34,9 @@ tags: - Ingress Tool Transfer - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 59ba1052c0..49da85554b 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$. diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index 43090ee6a5..64126535b7 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index 51e64963b2..f8e091fb6b 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 2ad38acb69..51393548da 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -33,9 +33,7 @@ tags: - NOBELIUM Group - Domain Trust Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Windows AdFind Exe mitre_attack_id: diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml index 81a7364e62..9aed7a851c 100644 --- a/detections/endpoint/windows_apache_benchmark_binary.yml +++ b/detections/endpoint/windows_apache_benchmark_binary.yml @@ -31,9 +31,7 @@ tags: analytic_story: - MetaSploit asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: A known MetaSploit default payload has been identified on $dest$ ran by $user$, $parent_process_name$ spawning $process_name$. diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml index 12872292ee..8f42a03053 100644 --- a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: $Image$ is creating or connecting to a named pipe $PipeName$ in $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index 5b6928fc29..39e9ccb30f 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ in $Computer$ diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index bc7d8990df..3efdec428f 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: possible RMS admin tool named pipe was created in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index d12c0504a9..2b43d6b9d1 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$. diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index 67286a3f67..76398f155e 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. diff --git a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml index 342967e652..08e31d7b65 100644 --- a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml +++ b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml @@ -36,9 +36,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: a process with commandline $process$ tries to retrieve cache domain credential logon count in $dest$ diff --git a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml index 26b8e6091b..5270e5d973 100644 --- a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml +++ b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: process with commandline $process$ set or change the file association of a file with no file extension in $dest$ diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml index d1782d9062..895f27ffdf 100644 --- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml +++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml @@ -29,9 +29,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell script $ScriptBlockText$ execute Get-Clipboard commandlet in $dest$ diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 0257cca01e..72afeebbd2 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index c4d166916f..a1b2311a85 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index b398989aad..01a5becf0b 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -33,9 +33,7 @@ tags: - Windows Defense Evasion Tactics - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index fd57406ad2..ed1460ff5d 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -38,9 +38,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Multiple cmd.exe processes with child process of notepad.exe executed on $dest$ diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/endpoint/windows_command_shell_fetch_env_variables.yml index 2c99009622..21d2513631 100644 --- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml +++ b/detections/endpoint/windows_command_shell_fetch_env_variables.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: non-shell parent process has a child process $process_name$ with a commandline $process$ to fetch env variables in $dest$ diff --git a/detections/endpoint/windows_computer_account_created_by_computer_account.yml b/detections/endpoint/windows_computer_account_created_by_computer_account.yml index 9aa401a150..e9ac6f9174 100644 --- a/detections/endpoint/windows_computer_account_created_by_computer_account.yml +++ b/detections/endpoint/windows_computer_account_created_by_computer_account.yml @@ -28,9 +28,7 @@ tags: - Active Directory Kerberos Attacks - Local Privilege Escalation With KrbRelayUp asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack. diff --git a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml index 5305512a39..2f25ce5be9 100644 --- a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml +++ b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml @@ -27,9 +27,7 @@ tags: - Active Directory Kerberos Attacks - Local Privilege Escalation With KrbRelayUp asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack. diff --git a/detections/endpoint/windows_computer_account_with_spn.yml b/detections/endpoint/windows_computer_account_with_spn.yml index a69cdc51dd..2a79636852 100644 --- a/detections/endpoint/windows_computer_account_with_spn.yml +++ b/detections/endpoint/windows_computer_account_with_spn.yml @@ -29,9 +29,7 @@ tags: - Active Directory Kerberos Attacks - Local Privilege Escalation With KrbRelayUp asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack. diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index 6d66a7b13c..271eb6e885 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Account Monitoring and Controls asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 20 message: The following $user$ was added to $dest$ as a local account. mitre_attack_id: diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml index c8531e7edc..be6e9076b5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_query.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml @@ -34,9 +34,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a process $process_name$ was executed in $dest$ to display stored username and credentials. diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml index 6588954d19..fa3cf3bc34 100644 --- a/detections/endpoint/windows_credentials_in_registry_reg_query.yml +++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml @@ -38,9 +38,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: reg query commandline $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1147325bbe..fd7e03fec5 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -38,9 +38,7 @@ tags: - IcedID - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 194593828a..f3612b9047 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -46,9 +46,7 @@ tags: analytic_story: - Ingress Tool Transfer asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index a1239f5dd8..6c672ce9c7 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: modification or creation of transcodedwallpaper file by $process_name$ in $dest$ diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 0e8d2a9f81..6c7bc74052 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -42,9 +42,7 @@ tags: - Azorult - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: exclusion registry $registry_path$ modified or added on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 63dd4a2e92..9e232fc9f6 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Double Zero Destructor asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$ diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 87f18fcd9f..91ecec1571 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -42,9 +42,7 @@ tags: - Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification in "DisableChangePassword" on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index c3748a7fd5..26fd828777 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification in "DisableLockWorkstation" on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 806e48738d..f8fdadfac4 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -45,9 +45,7 @@ tags: - Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification in "NoLogOff" on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index b433453584..9e7eb21fc9 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -41,9 +41,7 @@ tags: - Hermetic Wiper - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index 12205ca876..01109673a8 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -38,9 +38,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: The Windows notification center was disabled on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 1d4c7d7f85..fc08d51b28 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -41,9 +41,7 @@ tags: - Ransomware - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification in "shutdownwithoutlogon" on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 13442610de..45b8478762 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -44,9 +44,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification to disable windows features on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index 51912d2e14..8e733d6a28 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -35,9 +35,7 @@ tags: - Azorult - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml index 1e27fe76d6..45cd80de25 100644 --- a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +++ b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml @@ -48,9 +48,7 @@ tags: - Active Directory Password Spraying - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 5838113496..3f5ba485a2 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index 3b8544ebf4..02089273b7 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Possible Signed Binary Proxy Execution on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index e9c4df1290..1cd6738edf 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml index 7163c067a7..d7ce319f00 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml @@ -41,9 +41,7 @@ tags: - Living Off The Land - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 10 - drilldown_search: [] impact: 10 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking. diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index 9900e53483..e354c5b57a 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -35,9 +35,7 @@ tags: - Windows Defense Evasion Tactics - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 10 - drilldown_search: [] impact: 10 message: An instance of $parent_process_name$ loading $process_name$ was identified on endpoint $dest$. diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index 5dbb7c70f0..a17caed8c7 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -35,9 +35,7 @@ tags: - Windows Defense Evasion Tactics - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access. diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index 179425b31f..cf488036f7 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$ diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml index 95099cd71c..0992d7c0bf 100644 --- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: calc.exe has a child process $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index 7e82d4cd3c..e16fe59956 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -44,9 +44,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 537a20f47f..1cb8b4c292 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -32,9 +32,7 @@ tags: - CISA AA22-320A - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: A kernel mode driver was loaded from a non-standard path on $ComputerName$. mitre_attack_id: diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index e3508053a7..dccc3b4071 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -34,9 +34,7 @@ tags: - CISA AA22-320A - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: A driver has loaded on $Computer$. mitre_attack_id: diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 2139c09c98..1b068fd48a 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Service was disabled on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 856700b012..ec3e570497 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -32,9 +32,7 @@ tags: - Clop Ransomware - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: Windows event logs cleared on $dest$ via EventCode $EventCode$ mitre_attack_id: diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index dd650b2205..b0f4cdf570 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred. diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml index 95a7af492a..e4dec6ce09 100644 --- a/detections/endpoint/windows_excessive_disabled_services_event.yml +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Service was disabled in $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 5a1bf5deb8..6292a2c345 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -38,11 +38,9 @@ tags: analytic_story: - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2022-30190 - drilldown_search: [] impact: 100 message: A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index 4a57639d9b..91d1a4fdd1 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -30,9 +30,7 @@ tags: analytic_story: - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: a process $Image$ is having a FTP connection to $DestinationHostname$ in $Computer$ diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index ffa0b59b89..e5e10c6902 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -35,9 +35,7 @@ tags: - Data Destruction - Hermetic Wiper asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: Driver file with out file extension drop in $file_path$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index fa9ba2d4ba..d9ed592456 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -30,9 +30,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: powershell script $ScriptBlockText$ to enumerate camera in $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 2a93e2daab..56bb7520d6 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information. diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml index 4b5c06dbb1..2e98aa44c4 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -30,9 +30,7 @@ tags: - Azorult - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: process connecting IP location web services on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml index da32bec0be..0597ee6112 100644 --- a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: Suspicious PowerShell Get-ADComputer was identified on endpoint $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml index d225fcc18d..6b8d4fbab4 100644 --- a/detections/endpoint/windows_hidden_schedule_task_settings.yml +++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml @@ -29,9 +29,7 @@ tags: - Active Directory Discovery - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A schedule task with hidden setting enable in host $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 003e957cd8..806916c904 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -39,9 +39,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Registry modification to hide windows notification on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index deb823181c..4c31d79b12 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -32,9 +32,7 @@ tags: - WhisperGate - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: High frequency file deletion activity detected on host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml index 76b586299b..3a3d5b1e0d 100644 --- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml +++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index 4e8354a6b4..2bdf8233ed 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details. diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 5f1d663481..cfc91df006 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -41,9 +41,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml index 6e5a628b1c..aa0d0d9e8e 100644 --- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml +++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Applocker importing xml policy command was executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 2980326a6c..a7b4a3121b 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -34,9 +34,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Windows Defender context menu registry key deleted on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index 4d9c031559..0750f56d59 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -34,9 +34,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml index e5ed514e3d..cc4b3dccb8 100644 --- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: Applocker registry modification to deny the action of several AV products on $dest$. diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 51bfd3d1a6..68ec376fb3 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -34,9 +34,7 @@ tags: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 30 message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 671b17d517..b4f699a49a 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ mitre_attack_id: diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index a8f941f979..4ebecf9013 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ mitre_attack_id: diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index df22a0e1fe..55189c4f6c 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -35,9 +35,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: excessive forfiles process execution in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml index 0830f095af..4f1a959751 100644 --- a/detections/endpoint/windows_information_discovery_fsutil.yml +++ b/detections/endpoint/windows_information_discovery_fsutil.yml @@ -34,9 +34,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: process $process_name$ with commandline $process$ is executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index d27040da33..19e4142363 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -36,9 +36,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload. diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index 66c3ead076..c21c515b65 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: a process $Image$ loaded $ImageLoaded$ in $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 4602970bee..c60de2503b 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Signed Binary Proxy Execution InstallUtil asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 1430dbc877..50592475b5 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -40,9 +40,7 @@ tags: - WhisperGate - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index aa6d735f13..214b13848d 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -45,9 +45,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 7108e5c738..16f0720b85 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -47,9 +47,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index da5eb6dc8b..62068f2071 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -51,9 +51,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 8181ebbe96..7f79cfad56 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -43,9 +43,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. diff --git a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml index 5f515d3c0d..b0832665df 100644 --- a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml +++ b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml @@ -48,9 +48,7 @@ tags: - Active Directory Password Spraying - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index bdbe74c07f..b0d912da4b 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -41,9 +41,7 @@ tags: - Azorult - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 80 message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 17ee1797b2..e0b8774033 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -33,11 +33,9 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-44228 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index 2d51cc6608..e4891551c5 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -29,9 +29,7 @@ tags: - Active Directory Kerberos Attacks - Local Privilege Escalation With KrbRelayUp asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack. diff --git a/detections/endpoint/windows_krbrelayup_service_creation.yml b/detections/endpoint/windows_krbrelayup_service_creation.yml index bf2415dadc..9b7dbde1fa 100644 --- a/detections/endpoint/windows_krbrelayup_service_creation.yml +++ b/detections/endpoint/windows_krbrelayup_service_creation.yml @@ -24,9 +24,7 @@ tags: analytic_story: - Local Privilege Escalation With KrbRelayUp asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A service was created on $dest$, related to KrbRelayUp. mitre_attack_id: diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 8986169ce7..fb7dba46f2 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -28,9 +28,7 @@ tags: - Industroyer2 - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index 560ca15383..a6514d0326 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -31,9 +31,7 @@ tags: analytic_story: - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: a process $Image$ is having a SMTP connection to $DestinationHostname$ in $Computer$ diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml index d4c4a51004..8f7f1aaf40 100644 --- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml +++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: explorer.exe hash a suspicious parent process $parent_process_name$ in $dest$ diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index 3b0970f476..9a39e1db43 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -36,9 +36,7 @@ tags: - Credential Dumping - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting dump credentials. diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index 0cf0cf0bf2..8cf64228c4 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for DisallowRun settings was modified to enable in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 8618249e45..186e982126 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The registry for raw write notification settings was modified to disable in $dest$. diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index c3ab5faea4..c825c676f0 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for security center notification settings was modified to disable mode in $dest$ diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index 483910457c..42f04e4a76 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for WER settings was modified to be disabled on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index dbb65e4043..4e2f7e485c 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The registry for DisallowRun settings was modified to enable in $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml index c4e7d142a6..55d6559cca 100644 --- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml @@ -45,9 +45,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: registry with binary data $registry_path$ created by $process_name$ in $dest$ diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/endpoint/windows_modify_registry_reg_restore.yml index 1ebd71e4d5..4d7bd284bd 100644 --- a/detections/endpoint/windows_modify_registry_reg_restore.yml +++ b/detections/endpoint/windows_modify_registry_reg_restore.yml @@ -33,9 +33,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: execution of process $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index dbb670474e..38d394a49c 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: The regedit app was executed with silet mode parameter to import .reg file on $dest$. diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 92bbad33ad..387038b697 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index e52ef6197c..6645751631 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -40,9 +40,7 @@ tags: - Hermetic Wiper - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index d7879de1f4..0073233ebb 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. diff --git a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml index f270aa1bd7..87d4f189c0 100644 --- a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml +++ b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml @@ -28,9 +28,7 @@ tags: - ProxyShell - ProxyNotShell asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 40 message: Cmdlets related to ProxyShell and ProxyNotShell have been identified on $dest$. diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index b3461fe379..0250f6a7cb 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -35,9 +35,7 @@ tags: - Suspicious Windows Registry Activities - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: a registry $registry_path$ contains mshta $registry_value_data$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 48dc2b2ddd..45ba1aa89d 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 8650ad6400..f06a90f4f6 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index f272dff112..a11c294d8c 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 7634d94a95..91f655184f 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file. diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml index bbe582c107..94c93d6c31 100644 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ b/detections/endpoint/windows_msiexec_with_network_connections.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination. diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml index 33d66d7959..208edc82af 100644 --- a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml +++ b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml @@ -28,9 +28,7 @@ tags: analytic_story: - AgentTesla asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a process $Image$ is having a dns query in a tor domain $QueryName$ in $Computer$ diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index ef1f1f48b0..a04f61540c 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -33,9 +33,7 @@ tags: - Reverse Network Proxy - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 50 message: A reverse proxy was identified spawning from $parent_process_name$ - $process_name$ on endpoint $dest$ by user $user$. diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 2d1c320a44..ae5db73c4f 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -35,9 +35,7 @@ tags: - Ransomware - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 60 message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$. diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 0add526ca9..9f2cf8fd96 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -31,9 +31,7 @@ tags: analytic_story: - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index ebd71e5621..9579835494 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index b117fd87a4..f732a4abf9 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index 1e18114efa..50b760b7f6 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 01473589bf..da1742992a 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 61ea5248e1..3e15d745fc 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -38,11 +38,9 @@ tags: - Spearphishing Attachments - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2022-30190 - drilldown_search: [] impact: 100 message: Office parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$. diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index ce7c79c87b..bbf16ad07f 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -40,9 +40,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a process with commandline $process$ that can retrieve information related to password manager databases in $dest$ diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index 3225303836..8fba869506 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -41,9 +41,7 @@ tags: - Azorult - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 10167d531c..ecb89543e1 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -55,9 +55,7 @@ tags: - CISA AA22-257A - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index 710c449ec1..bfb3cebfeb 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ diff --git a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml index ebf38d311b..f1ee7ebe9f 100644 --- a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index 58abf1ba90..799c0981b2 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: PowerView commandlets used for requesting SPN service ticket executed on $Computer$ diff --git a/detections/endpoint/windows_powerview_spn_discovery.yml b/detections/endpoint/windows_powerview_spn_discovery.yml index d33b0fc5c0..0e5f167e11 100644 --- a/detections/endpoint/windows_powerview_spn_discovery.yml +++ b/detections/endpoint/windows_powerview_spn_discovery.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 30 message: PowerView commandlets used for SPN discovery executed on $Computer$ mitre_attack_id: diff --git a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml index 8b57d3c556..3b3cf2e1fb 100644 --- a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 08383d6435..a47b8efeca 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -38,9 +38,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: a process with commandline $process$ that can retrieve information related to private keys in $dest$ diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml index 13ac23c864..291e638976 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: wermgr.exe process $SourceImage$ create a remote thread to a browser process $TargetImage$ in host $Computer$ diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 25251372b3..a0d1deebeb 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Qakbot asset_type: 80 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$ diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index 8844964e05..93c3b8f9c9 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 80 message: wermgr parent process has a child process $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 5a12190cbb..65eb9d9381 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: 80 - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$ diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index d9b205e387..26656dba92 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Process with named pipe in $process$ on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml index 3b04e92f07..59be9f3d7f 100644 --- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Industroyer2 asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: process was terminated $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml index cce4c048d1..ff248b9ae6 100644 --- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml +++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml @@ -35,9 +35,7 @@ tags: analytic_story: - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination. diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/endpoint/windows_query_registry_reg_save.yml index 6e962badf9..dc83b6a07f 100644 --- a/detections/endpoint/windows_query_registry_reg_save.yml +++ b/detections/endpoint/windows_query_registry_reg_save.yml @@ -35,9 +35,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: execution of process $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 649e480228..c428309790 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index e4e5168a25..67465886ef 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 8264c8669f..30b3495172 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -32,9 +32,7 @@ tags: - Hermetic Wiper - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: Process accessing disk partition $device$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 20d937e2e2..84a8e71730 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -35,9 +35,7 @@ tags: - Hermetic Wiper - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: process accessing MBR $device$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index c8dbfec5b9..5143bb9830 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -41,9 +41,7 @@ tags: - Windows Drivers - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: A root certificate was added on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml index 4eac2798f7..4dc9ce7955 100644 --- a/detections/endpoint/windows_registry_delete_task_sd.yml +++ b/detections/endpoint/windows_registry_delete_task_sd.yml @@ -37,9 +37,7 @@ tags: - Windows Registry Abuse - Windows Persistence Techniques asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A scheduled task security descriptor was deleted from the registry on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index c4dda56667..cf44c7ec26 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -41,9 +41,7 @@ tags: - Windows Registry Abuse - Windows Drivers asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/endpoint/windows_regsvr32_renamed_binary.yml index a6e47ad871..d0934030bf 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/endpoint/windows_regsvr32_renamed_binary.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: regsvr32 was renamed as $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml index ad0df895c1..055f1a005f 100644 --- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml +++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml @@ -47,9 +47,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$. diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml index 6706251a02..1e0e513a71 100644 --- a/detections/endpoint/windows_remote_access_software_hunt.yml +++ b/detections/endpoint/windows_remote_access_software_hunt.yml @@ -37,9 +37,7 @@ tags: - Command and Control - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 10 - drilldown_search: [] impact: 10 message: The following Remote Access Software $process_name$ was identified on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml index c7f2489905..030fab0620 100644 --- a/detections/endpoint/windows_remote_access_software_rms_registry.yml +++ b/detections/endpoint/windows_remote_access_software_rms_registry.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: the registry related to RMS tool is created in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index ce9c80e6e9..099ac519da 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe. diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index e54a78c669..021f62fbe3 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: Rdpwinst.exe executed on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index ffe68c44a7..ae8591d497 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: new firewall rules was added to allow rdp connection to $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index a6f170454c..82bf0a1619 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for rdp protocol was modified to enable in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index f156afdf8b..dac5a2df27 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: the registry for rdp protocol was modified to enable in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index aa16852c54..e4f0d009ff 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -27,9 +27,7 @@ tags: - Industroyer2 - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index b429a6d09d..fad57d032c 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -33,9 +33,7 @@ tags: - Windows Persistence Techniques - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 80 message: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM. diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index 56ec69d8ad..eb9996cdda 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Ryuk Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: 'The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$' diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml index 948ea377fb..f726680945 100644 --- a/detections/endpoint/windows_security_support_provider_reg_query.yml +++ b/detections/endpoint/windows_security_support_provider_reg_query.yml @@ -38,9 +38,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: process with reg query command line $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml index 2bb9eee567..001b59da02 100644 --- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml +++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml @@ -30,9 +30,7 @@ tags: - Windows Drivers - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 60 message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$. diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 98c34b9d1d..bbcbb14229 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -33,9 +33,7 @@ tags: - Brute Ratel C4 - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$ diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 97e2c98f0d..087bc79284 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A Windows Service $Service_File_Name$ with a public path was created on $ComputerName diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index b0b3dd3577..b090b6ad5e 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A Windows Service was created on a remote endpoint from $dest mitre_attack_id: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 73ae1d2d43..d9f307857f 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -42,9 +42,7 @@ tags: - Windows Registry Abuse - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: A Windows Service was created on a endpoint from $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 258526a6d6..dd0f3801ff 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Brute Ratel C4 asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 60 message: A service was deleted on $dest$ within the Windows registry. mitre_attack_id: diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index ad503da286..ca15edbd82 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -29,9 +29,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: A Windows Service was started on a remote endpoint from $dest mitre_attack_id: diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index d12693762e..7623760fc0 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service. diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml index d11cb2a104..5271c46712 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: $process$ was executed on $dest$ attempting to stop service. mitre_attack_id: diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml index 1654f0fe83..9c1b1c69e3 100644 --- a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml +++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml @@ -33,9 +33,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: process klist.exe executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 4ab2e0351d..a140b74046 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -34,9 +34,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$. diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml index 453fe883df..594ab30b9b 100644 --- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: System nslookup domain discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_discovery_using_qwinsta.yml b/detections/endpoint/windows_system_discovery_using_qwinsta.yml index e34b7df79b..21758fbc70 100644 --- a/detections/endpoint/windows_system_discovery_using_qwinsta.yml +++ b/detections/endpoint/windows_system_discovery_using_qwinsta.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: System qwinsta domain discovery on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index 024d6a0fb8..7b7c44c8a1 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -31,9 +31,7 @@ tags: - Windows Drivers - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 20 message: A new driver is present on $dest$. mitre_attack_id: diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index 1d97698317..a94a2949e8 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -35,9 +35,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Process name $process_name$ is seen to execute logoff commandline on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index a13588e4a4..0cc5921971 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -36,9 +36,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: process $process_name$ with commandline $process$ is executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index 9b0cf045aa..a478085cd9 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -36,9 +36,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: netsh process with command line $process$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 6b6d00b27f..af86d52fe0 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -36,9 +36,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: Process $process_name$ that executed reboot via commandline on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 2168872b13..e0dfce52ef 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download files or evade critical diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 76fab35d7c..b8330bd837 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -35,9 +35,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Process $process_name$ seen to execute shutdown via commandline on $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 4a0a2d4476..da40ab2c3d 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -34,9 +34,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: Process name w32tm.exe is using suspcicious command line arguments $process$ on host $dest$. diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 07a6f7aee4..0527fcf115 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -39,9 +39,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 30 message: execution of process $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index b8dadf9849..21f424b425 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Double Zero Destructor asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: a process $SourceImage$ terminates Lsass process in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml index ddc12a6ec5..300e8f50ad 100644 --- a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml @@ -53,9 +53,7 @@ tags: - Active Directory Password Spraying - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Potential password spraying attack from $ComputerName$ mitre_attack_id: diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml index 2e65d385b1..55817eb2ce 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 1940bd15c4..1032262ebe 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process in $dest$ diff --git a/detections/endpoint/windows_wmi_process_and_service_list.yml b/detections/endpoint/windows_wmi_process_and_service_list.yml index e2b5c8398e..39e1e9e893 100644 --- a/detections/endpoint/windows_wmi_process_and_service_list.yml +++ b/detections/endpoint/windows_wmi_process_and_service_list.yml @@ -34,9 +34,7 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 20 message: wmi command $process$ to list processes and services in $dest$ mitre_attack_id: diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 64f998ec2d..fc80674c3f 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -33,9 +33,7 @@ tags: - Suspicious WMI Use - Qakbot asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: process with $process$ commandline executed in $dest$ mitre_attack_id: diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 4a5d760eba..056a52ad20 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -50,9 +50,7 @@ tags: - Ryuk Ransomware - CISA AA22-257A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: 'A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$' diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index e04d632ab0..bfd68445f4 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -54,9 +54,7 @@ tags: - CISA AA22-257A - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: 'A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$' diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a73aa1f267..414c22e0a3 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -37,9 +37,7 @@ tags: - Qakbot - Prestige Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: A Scheduled Task was scheduled and ran on $dest$. mitre_attack_id: diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 3ffe131c36..b7fad766dd 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Remcos asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. diff --git a/detections/endpoint/winrm_spawning_a_process.yml b/detections/endpoint/winrm_spawning_a_process.yml index a1b3a9e2ab..f086e37a2b 100644 --- a/detections/endpoint/winrm_spawning_a_process.yml +++ b/detections/endpoint/winrm_spawning_a_process.yml @@ -32,11 +32,9 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2021-31166 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 17a98cae79..fc9ec7244c 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -35,9 +35,7 @@ tags: - Spearphishing Attachments - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: '$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.' diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index f994e67b78..e5b6d08245 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -37,9 +37,7 @@ tags: - Spearphishing Attachments - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: '$parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks' diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 1a7d53f45f..b1be699d7e 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -34,9 +34,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 70 message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe mitre_attack_id: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index eecd704082..3bef95a501 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -23,9 +23,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 60ec1316ca..0e9cb9ee24 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -45,9 +45,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 30 message: 'User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$' diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index e9d9406997..36524032fb 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -31,9 +31,7 @@ tags: - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 20 message: Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index d8ff967d11..1d84a38b58 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index af56cc7063..b10ec788d5 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: Local group discovery on $dest$ by $user$. mitre_attack_id: diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index 6c8f32ed7f..38e3fe23b2 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -34,9 +34,7 @@ tags: - IcedID - Azorult asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 37ee8ed67c..a146a493c7 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. diff --git a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml index 27ed1a3c10..018483a39a 100644 --- a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: Wmiprsve.exe spawned a LOLBAS process on $dest$. mitre_attack_id: diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index d4e5edda43..098cad2826 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: wscript or cscript parent process spawned $process_name$ in $dest$ mitre_attack_id: diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml index 10fa16a0bb..b5707075a8 100644 --- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 90 message: Wsmprovhost.exe spawned a LOLBAS process on $dest$. mitre_attack_id: diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 4e2537508c..2c646ca867 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -40,9 +40,7 @@ tags: - Living Off The Land - Windows Registry Abuse asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index b3d2325cd1..ab40fde4b1 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -25,9 +25,7 @@ tags: - XMRig - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ mitre_attack_id: diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 0a384af3c4..baca5f9806 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -33,9 +33,7 @@ tags: - FIN7 - Suspicious WMI Use asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 403c9e5851..f141d0ba15 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml index 7776dcdaf8..ef457ae8b3 100644 --- a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml @@ -55,9 +55,7 @@ tags: - Dynamic DNS - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A potential connection to a DGA domain $domain$ was detected from host $src$, kindly review. diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index ddc1c8ff14..2c97c9db5e 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -53,9 +53,7 @@ tags: - Dynamic DNS - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A dns query $query$ from your infra connecting to suspicious domain in host $host$ diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml index cdeef8475b..88518edeef 100644 --- a/detections/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 6265493f27..3e33359814 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 6d6c461b8d..10f1357467 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -30,11 +30,9 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2021-44228 - drilldown_search: [] impact: 70 message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 50f88ddbd0..7e4139c311 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -43,9 +43,7 @@ tags: - DHS Report TA18-074A - NOBELIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml index aaec3eaf8f..1d53826224 100644 --- a/detections/network/detect_port_security_violation.yml +++ b/detections/network/detect_port_security_violation.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml index 62818dd158..9b0b2400ec 100644 --- a/detections/network/detect_rogue_dhcp_server.yml +++ b/detections/network/detect_rogue_dhcp_server.yml @@ -27,9 +27,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/network/detect_snicat_sni_exfiltration.yml index 4cd4496707..19cf02b24c 100644 --- a/detections/network/detect_snicat_sni_exfiltration.yml +++ b/detections/network/detect_snicat_sni_exfiltration.yml @@ -26,9 +26,7 @@ tags: analytic_story: - Data Exfiltration asset_type: Network - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml index f3ea3f9e5f..53944a2870 100644 --- a/detections/network/detect_software_download_to_network_device.yml +++ b/detections/network/detect_software_download_to_network_device.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index d0f97eecf7..2e13adc6ee 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Router and Infrastructure Security asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml index 516dc50828..3b71649190 100644 --- a/detections/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/network/detect_unauthorized_assets_by_mac_address.yml @@ -32,9 +32,7 @@ tags: analytic_story: - Asset Tracking asset_type: Infrastructure - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 7da9fa1f26..8f0ffcd761 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -21,11 +21,9 @@ tags: analytic_story: - Windows DNS SIGRed CVE-2020-1350 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2020-1350 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index f6d66f5b42..922363b561 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -23,11 +23,9 @@ tags: analytic_story: - Windows DNS SIGRed CVE-2020-1350 asset_type: Endpoint - atomic_guid: [] confidence: 50 cve: - CVE-2020-1350 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index d334df58fc..a4049da7db 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -26,11 +26,9 @@ tags: analytic_story: - Detect Zerologon Attack asset_type: Network - atomic_guid: [] confidence: 50 cve: - CVE-2020-1472 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml index e23ecb4cd2..32ed8cc12b 100644 --- a/detections/network/dns_query_length_outliers___mltk.yml +++ b/detections/network/dns_query_length_outliers___mltk.yml @@ -53,9 +53,7 @@ tags: - Suspicious DNS Traffic - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 8da356931a..18d49e37f8 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -26,9 +26,7 @@ tags: - Suspicious DNS Traffic - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ diff --git a/detections/network/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml index a300c58a5c..6a3ade9b11 100644 --- a/detections/network/excessive_dns_failures.yml +++ b/detections/network/excessive_dns_failures.yml @@ -26,9 +26,7 @@ tags: - Suspicious DNS Traffic - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml index 1975b85af6..e14936c03c 100644 --- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml +++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml @@ -31,11 +31,9 @@ tags: analytic_story: - F5 BIG-IP Vulnerability CVE-2022-1388 asset_type: Web Server - atomic_guid: [] confidence: 70 cve: - CVE-2022-1388 - drilldown_search: [] impact: 100 message: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred. diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index 42220f2e30..c3fb2ddf90 100644 --- a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Collection and Staging asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml index a7903ff82a..a529d190d5 100644 --- a/detections/network/large_volume_of_dns_any_queries.yml +++ b/detections/network/large_volume_of_dns_any_queries.yml @@ -21,9 +21,7 @@ tags: analytic_story: - DNS Amplification Attacks asset_type: DNS Servers - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index af7ac745a2..dc2deeee79 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -36,9 +36,7 @@ tags: - Data Exfiltration - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml index 0ec58351e1..70c9576320 100644 --- a/detections/network/ngrok_reverse_proxy_on_network.yml +++ b/detections/network/ngrok_reverse_proxy_on_network.yml @@ -26,9 +26,7 @@ tags: - Reverse Network Proxy - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 50 message: An endpoint, $src$, is beaconing out to the reverse proxy service of Ngrok. mitre_attack_id: diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 29b7e3597d..2dd3285ba8 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -26,9 +26,7 @@ tags: - Data Exfiltration - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index c5cd659cb9..d851883af0 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -29,9 +29,7 @@ tags: - Ransomware - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/protocol_or_port_mismatch.yml b/detections/network/protocol_or_port_mismatch.yml index 4d22aaa46d..4563567ef7 100644 --- a/detections/network/protocol_or_port_mismatch.yml +++ b/detections/network/protocol_or_port_mismatch.yml @@ -31,9 +31,7 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml index a2328b0eb4..9aa99d8068 100644 --- a/detections/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/network/protocols_passing_authentication_in_cleartext.yml @@ -31,9 +31,7 @@ tags: analytic_story: - Use of Cleartext Protocols asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 764e17f6ed..fdd7843319 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -25,9 +25,7 @@ tags: - SamSam Ransomware - Ryuk Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index 47e6c64f9d..7a52a74610 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -35,9 +35,7 @@ tags: - Hidden Cobra Malware - Active Directory Lateral Movement asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index 0b5b2a79c1..023ebbf4c7 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -28,9 +28,7 @@ tags: - Ransomware - DHS Report TA18-074A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml index a43f9782fd..713d5731fc 100644 --- a/detections/network/smb_traffic_spike___mltk.yml +++ b/detections/network/smb_traffic_spike___mltk.yml @@ -49,9 +49,7 @@ tags: - Ransomware - DHS Report TA18-074A asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index dea303e0e7..1ef406c76d 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -30,12 +30,10 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Proxy - atomic_guid: [] confidence: 70 cve: - CVE-2022-32151 - CVE-2022-32152 - drilldown_search: [] impact: 60 message: The following $dest$ is using the self signed Splunk certificate. mitre_attack_id: diff --git a/detections/network/ssl_certificates_with_punycode.yml b/detections/network/ssl_certificates_with_punycode.yml index 4d8e9b81e5..040364d11c 100644 --- a/detections/network/ssl_certificates_with_punycode.yml +++ b/detections/network/ssl_certificates_with_punycode.yml @@ -36,9 +36,7 @@ tags: analytic_story: - OpenSSL CVE-2022-3602 asset_type: Network - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 50 message: A x509 certificate has been identified to have punycode in the SSL issuer email domain on $dest$. diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index f5fa95e755..317993752d 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -28,9 +28,7 @@ tags: - NOBELIUM Group - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/network/unusually_long_content_type_length.yml b/detections/network/unusually_long_content_type_length.yml index 99140276c6..fba6859cd6 100644 --- a/detections/network/unusually_long_content_type_length.yml +++ b/detections/network/unusually_long_content_type_length.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Apache Struts Vulnerability asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/network/zeek_x509_certificate_with_punycode.yml b/detections/network/zeek_x509_certificate_with_punycode.yml index 222af1721e..219d3bf04a 100644 --- a/detections/network/zeek_x509_certificate_with_punycode.yml +++ b/detections/network/zeek_x509_certificate_with_punycode.yml @@ -36,9 +36,7 @@ tags: analytic_story: - OpenSSL CVE-2022-3602 asset_type: Network - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 50 message: A x509 certificate has been identified to have punycode in the subject alternative name on $dest$. diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index efffdb5b24..fed9d3d4e1 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -35,11 +35,9 @@ tags: analytic_story: - Atlassian Confluence Server and Data Center CVE-2022-26134 asset_type: Web Server - atomic_guid: [] confidence: 100 cve: - CVE-2022-26134 - drilldown_search: [] impact: 100 message: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. diff --git a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml index dddd41abfe..5cd65cfde8 100644 --- a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml +++ b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml @@ -24,9 +24,7 @@ tags: - JBoss Vulnerability - SamSam Ransomware asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml index 970f1b8948..e4a111eb43 100644 --- a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml @@ -24,11 +24,9 @@ tags: analytic_story: - F5 TMUI RCE CVE-2020-5902 asset_type: Network - atomic_guid: [] confidence: 50 cve: - CVE-2020-5902 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml index 33cf1ba7f2..31a32bf3ec 100644 --- a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml +++ b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml @@ -25,9 +25,7 @@ tags: - JBoss Vulnerability - SamSam Ransomware asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml index 472a3d7304..fc823edc1a 100644 --- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml +++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml @@ -47,11 +47,9 @@ tags: analytic_story: - Text4Shell CVE-2022-42889 asset_type: Web Server - atomic_guid: [] confidence: 70 cve: - CVE-2022-42889 - drilldown_search: [] impact: 70 message: A URL was requested related to Text4Shell on $dest$ by $src$. mitre_attack_id: diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml index 54930077b9..c46bfd6212 100644 --- a/detections/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -50,11 +50,9 @@ tags: analytic_story: - CVE-2022-40684 Fortinet Appliance Auth bypass asset_type: Network - atomic_guid: [] confidence: 90 cve: - CVE-2022-40684 - drilldown_search: [] impact: 90 message: Potential CVE-2022-40684 against a Fortinet appliance may be occurring against $dest$. diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index 1cfa501510..c47065a9ba 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -39,11 +39,9 @@ tags: - CISA AA22-257A - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 30 cve: - CVE-2021-44228 - drilldown_search: [] impact: 50 message: CVE-2021-44228 Log4Shell triggered for host $dest$ mitre_attack_id: diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index 45d5d08665..f302b83af3 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -34,11 +34,9 @@ tags: - Log4Shell CVE-2021-44228 - CISA AA22-320A asset_type: Endpoint - atomic_guid: [] confidence: 30 cve: - CVE-2021-44228 - drilldown_search: [] impact: 50 message: CVE-2021-44228 Log4Shell triggered for host $dest$ mitre_attack_id: diff --git a/detections/web/monitor_web_traffic_for_brand_abuse.yml b/detections/web/monitor_web_traffic_for_brand_abuse.yml index 865dd5a330..bea3ad3c02 100644 --- a/detections/web/monitor_web_traffic_for_brand_abuse.yml +++ b/detections/web/monitor_web_traffic_for_brand_abuse.yml @@ -21,9 +21,7 @@ tags: analytic_story: - Brand Monitoring asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd observable: diff --git a/detections/web/proxyshell_proxynotshell_behavior_detected.yml b/detections/web/proxyshell_proxynotshell_behavior_detected.yml index 0e2ea60ec3..f5df8ae1e1 100644 --- a/detections/web/proxyshell_proxynotshell_behavior_detected.yml +++ b/detections/web/proxyshell_proxynotshell_behavior_detected.yml @@ -43,9 +43,7 @@ tags: - ProxyShell - ProxyNotShell asset_type: Web Server - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 90 message: ProxyShell or ProxyNotShell activity has been identified on $risk_object$. mitre_attack_id: diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml index a695e991f9..0169e12930 100644 --- a/detections/web/spring4shell_payload_url_request.yml +++ b/detections/web/spring4shell_payload_url_request.yml @@ -27,11 +27,9 @@ tags: analytic_story: - Spring4Shell CVE-2022-22965 asset_type: Web Server - atomic_guid: [] confidence: 60 cve: - CVE-2022-22965 - drilldown_search: [] impact: 60 message: A URL was requested related to Spring4Shell POC code on $dest$ by $src$. mitre_attack_id: diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index 526a0d4308..cbcf23dc23 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -34,9 +34,7 @@ tags: analytic_story: - SQL Injection asset_type: Database Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: SQL injection attempt with url $url$ detected on $dest$ mitre_attack_id: diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml index 9820c102be..d5fa3848fb 100644 --- a/detections/web/supernova_webshell.yml +++ b/detections/web/supernova_webshell.yml @@ -25,9 +25,7 @@ tags: analytic_story: - NOBELIUM Group asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: tbd mitre_attack_id: diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index 9664010cbb..8a89a29344 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -31,11 +31,9 @@ tags: analytic_story: - VMware Server Side Injection and Privilege Escalation asset_type: Web Server - atomic_guid: [] confidence: 50 cve: - CVE-2022-22954 - drilldown_search: [] impact: 70 message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml index 37e54e2052..d2a763e73a 100644 --- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -32,11 +32,9 @@ tags: analytic_story: - VMware Server Side Injection and Privilege Escalation asset_type: Web Server - atomic_guid: [] confidence: 70 cve: - CVE-2022-22954 - drilldown_search: [] impact: 70 message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml index 0dbb21cf58..251a2b6c93 100644 --- a/detections/web/web_jsp_request_via_url.yml +++ b/detections/web/web_jsp_request_via_url.yml @@ -27,11 +27,9 @@ tags: analytic_story: - Spring4Shell CVE-2022-22965 asset_type: Web Server - atomic_guid: [] confidence: 80 cve: - CVE-2022-22965 - drilldown_search: [] impact: 90 message: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity. diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml index 2b60af81c0..63ab8562d8 100644 --- a/detections/web/web_spring4shell_http_request_class_module.yml +++ b/detections/web/web_spring4shell_http_request_class_module.yml @@ -26,11 +26,9 @@ tags: analytic_story: - Spring4Shell CVE-2022-22965 asset_type: Web Server - atomic_guid: [] confidence: 80 cve: - CVE-2022-22965 - drilldown_search: [] impact: 90 message: A http body request related to Spring4Shell has been sent to $dest$ by $src$. diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml index e5842ec528..631b687d86 100644 --- a/detections/web/web_spring_cloud_function_functionrouter.yml +++ b/detections/web/web_spring_cloud_function_functionrouter.yml @@ -28,11 +28,9 @@ tags: analytic_story: - Spring4Shell CVE-2022-22965 asset_type: Web Server - atomic_guid: [] confidence: 60 cve: - CVE-2022-22963 - drilldown_search: [] impact: 70 message: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud. diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml index 9eef25699d..7c15fbf0c1 100644 --- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml +++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml @@ -42,7 +42,6 @@ tags: - ProxyShell - ProxyNotShell asset_type: Web server - atomic_guid: [] confidence: 80 cve: - CVE-2021-34523 @@ -50,7 +49,6 @@ tags: - CVE-2021-31207 - CVE-2022-41040 - CVE-2022-41082 - drilldown_search: [] impact: 90 message: Activity related to ProxyShell or ProxyNotShell has been identified on $dest$. Review events and take action accordingly. From 08bf8f82ed71c73830a67815c26748550ed44cb3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 9 Jan 2023 12:46:04 +0100 Subject: [PATCH 6/7] Add drilldown searches --- .../application/factory/factory.py | 142 +++++++++--------- .../domain/entities/detection_tags.py | 2 + .../templates/savedsearches_detections.j2 | 4 + detections/endpoint/living_off_the_land.yml | 3 + detections/web/hunting_for_log4shell.yml | 2 - dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 22 +-- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- ...dential_extractionfgdump_and_cachedump.yml | 2 - ...ash_observed_at_the_destination_device.yml | 2 - ...observed_by_an_event_collecting_device.yml | 2 - ...unusual_lolbas_in_short_period_of_time.yml | 2 - .../ssa___unusually_long_command_line.yml | 2 - ...anomalous_usage_of_account_credentials.yml | 2 - ...ssa___anomalous_usage_of_archive_tools.yml | 2 - .../ssa___attempt_to_delete_services.yml | 2 - .../ssa___attempt_to_disable_services.yml | 2 - ...dential_dump_from_registry_via_reg_exe.yml | 2 - ..._bcdedit_failure_recovery_modification.yml | 8 +- ...ar_unallocated_sector_using_cipher_app.yml | 7 +- .../endpoint/ssa___delete_a_net_user.yml | 2 - ...___deny_permission_using_cacls_utility.yml | 2 - .../endpoint/ssa___detect_kerberoasting.yml | 2 - ...ohibited_applications_spawning_cmd_exe.yml | 7 +- ...ssa___detect_rclone_command_line_usage.yml | 7 +- ...___disable_defender_antivirus_registry.yml | 8 - .../ssa___disable_net_user_account.yml | 2 - ...___dns_exfiltration_using_nslookup_app.yml | 7 +- ...xcessive_number_of_office_files_copied.yml | 2 - ..._first_time_seen_command_line_argument.yml | 2 - .../endpoint/ssa___fsutil_zeroing_file.yml | 7 +- ...__grant_permission_using_cacls_utility.yml | 2 - ..._files_and_directories_with_attrib_exe.yml | 7 +- .../ssa___high_file_deletion_frequency.yml | 2 - ...fy_acls_permission_of_files_or_folders.yml | 2 - ...e_product_spawning_windows_script_host.yml | 7 +- ...rare_parent_child_process_relationship.yml | 2 - .../ssa___resize_shadowstorage_volume.yml | 2 - .../ssa___sdelete_application_execution.yml | 7 +- ...ocess_running_from_unexpected_location.yml | 2 - ...d_messaging_service_spawning_a_process.yml | 2 - .../ssa___wbadmin_delete_system_backups.yml | 2 - .../ssa___wevtutil_usage_to_clear_logs.yml | 2 - .../ssa___wevtutil_usage_to_disable_logs.yml | 2 - .../ssa___windows_bits_job_persistence.yml | 2 - .../ssa___windows_bitsadmin_download_file.yml | 2 - .../ssa___windows_certutil_decode_file.yml | 2 - ...a___windows_certutil_urlcache_download.yml | 2 - ...___windows_certutil_verifyctl_download.yml | 2 - ..._hijacking_inprocserver32_modification.yml | 2 - ...dows_curl_upload_to_remote_destination.yml | 2 - ...ws_defender_tools_in_non_standard_path.yml | 2 - ...a___windows_diskshadow_proxy_execution.yml | 2 - ...ows_dotnet_binary_in_non_standard_path.yml | 2 - .../ssa___windows_eventvwr_uac_bypass.yml | 2 - ...ndows_exchange_powershell_module_usage.yml | 2 - ...s_execute_arbitrary_commands_with_msdt.yml | 2 - ...s_ingress_tool_transfer_using_explorer.yml | 2 - ...ows_lolbin_binary_in_non_standard_path.yml | 2 - .../ssa___windows_mshta_child_process.yml | 2 - .../ssa___windows_mshta_command_line_url.yml | 2 - ...a___windows_mshta_inline_hta_execution.yml | 2 - ...___windows_odbcconf_load_response_file.yml | 2 - ...tial_dumping_with_ntdsutil_export_ntds.yml | 2 - ...ws_os_credential_dumping_with_procdump.yml | 2 - ...connect_to_internet_with_hidden_window.yml | 2 - ...re_authentication_discovery_get_aduser.yml | 2 - ...uthentication_discovery_with_powerview.yml | 2 - .../ssa___windows_powershell_downloadfile.yml | 2 - ..._windows_powershell_start_bitstransfer.yml | 2 - .../ssa___windows_rasautou_dll_execution.yml | 2 - ...onsole_exe_lolbas_in_non_standard_path.yml | 2 - ...adplus_exe_lolbas_in_non_standard_path.yml | 2 - ...dvpack_dll_lolbas_in_non_standard_path.yml | 2 - ...ecutor_exe_lolbas_in_non_standard_path.yml | 2 - ...taller_exe_lolbas_in_non_standard_path.yml | 2 - ...appvlp_exe_lolbas_in_non_standard_path.yml | 2 - ...mpiler_exe_lolbas_in_non_standard_path.yml | 2 - ...ies_at_exe_lolbas_in_non_standard_path.yml | 2 - ...broker_exe_lolbas_in_non_standard_path.yml | 2 - ...__windows_rundll32_comsvcs_memory_dump.yml | 2 - ..._windows_rundll32_inline_hta_execution.yml | 2 - ...sa___windows_script_host_spawn_msbuild.yml | 2 - ...execution_compiled_html_file_decompile.yml | 2 - ...compiled_html_file_url_in_command_line.yml | 2 - ...l_file_using_infotech_storage_handlers.yml | 2 - ...xy_execution_msiexec_dllregisterserver.yml | 2 - ...roxy_execution_msiexec_remote_download.yml | 2 - ...proxy_execution_msiexec_unregister_dll.yml | 2 - .../ssa___windows_wmiprvse_spawn_msbuild.yml | 2 - .../ssa___windows_wsreset_uac_bypass.yml | 2 - ...ting_interpreter_outbound_ldap_traffic.yml | 2 - ...wnload_from_internal_server_per_entity.yml | 2 - 97 files changed, 116 insertions(+), 293 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/application/factory/factory.py b/bin/contentctl_project/contentctl_core/application/factory/factory.py index b2d4ded605..aa2d461b41 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/factory.py @@ -103,80 +103,80 @@ class Factory(): #Index + 1 because we are zero indexed, not 1 indexed. This ensures # that printouts end at 100%, not some other number progress_percent = ((index+1)/len(files_without_ssa)) * 100 -# try: - type_string = "UNKNOWN TYPE" - if type == SecurityContentType.lookups: - type_string = "Lookups" - self.input_dto.director.constructLookup(self.input_dto.basic_builder, str(file)) - lookup = self.input_dto.basic_builder.getObject() - Utils.add_id(self.ids, lookup, file) - self.output_dto.lookups.append(lookup) - - elif type == SecurityContentType.macros: - type_string = "Macros" - self.input_dto.director.constructMacro(self.input_dto.basic_builder, str(file)) - macro = self.input_dto.basic_builder.getObject() - Utils.add_id(self.ids, macro, file) - self.output_dto.macros.append(macro) - - elif type == SecurityContentType.deployments: - type_string = "Deployments" - self.input_dto.director.constructDeployment(self.input_dto.basic_builder, str(file)) - deployment = self.input_dto.basic_builder.getObject() - Utils.add_id(self.ids, deployment, file) - self.output_dto.deployments.append(deployment) - - elif type == SecurityContentType.playbooks: - type_string = "Playbooks" - self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, str(file)) - playbook = self.input_dto.playbook_builder.getObject() - Utils.add_id(self.ids, playbook, file) - self.output_dto.playbooks.append(playbook) - - elif type == SecurityContentType.baselines: - type_string = "Baselines" - self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, str(file), self.output_dto.deployments) - baseline = self.input_dto.baseline_builder.getObject() - Utils.add_id(self.ids, baseline, file) - self.output_dto.baselines.append(baseline) - - elif type == SecurityContentType.investigations: - type_string = "Investigations" - self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file) - investigation = self.input_dto.investigation_builder.getObject() - Utils.add_id(self.ids, investigation, file) - self.output_dto.investigations.append(investigation) + try: + type_string = "UNKNOWN TYPE" + if type == SecurityContentType.lookups: + type_string = "Lookups" + self.input_dto.director.constructLookup(self.input_dto.basic_builder, str(file)) + lookup = self.input_dto.basic_builder.getObject() + Utils.add_id(self.ids, lookup, file) + self.output_dto.lookups.append(lookup) + + elif type == SecurityContentType.macros: + type_string = "Macros" + self.input_dto.director.constructMacro(self.input_dto.basic_builder, str(file)) + macro = self.input_dto.basic_builder.getObject() + Utils.add_id(self.ids, macro, file) + self.output_dto.macros.append(macro) + + elif type == SecurityContentType.deployments: + type_string = "Deployments" + self.input_dto.director.constructDeployment(self.input_dto.basic_builder, str(file)) + deployment = self.input_dto.basic_builder.getObject() + Utils.add_id(self.ids, deployment, file) + self.output_dto.deployments.append(deployment) + + elif type == SecurityContentType.playbooks: + type_string = "Playbooks" + self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, str(file)) + playbook = self.input_dto.playbook_builder.getObject() + Utils.add_id(self.ids, playbook, file) + self.output_dto.playbooks.append(playbook) + + elif type == SecurityContentType.baselines: + type_string = "Baselines" + self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, str(file), self.output_dto.deployments) + baseline = self.input_dto.baseline_builder.getObject() + Utils.add_id(self.ids, baseline, file) + self.output_dto.baselines.append(baseline) + + elif type == SecurityContentType.investigations: + type_string = "Investigations" + self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file) + investigation = self.input_dto.investigation_builder.getObject() + Utils.add_id(self.ids, investigation, file) + self.output_dto.investigations.append(investigation) - elif type == SecurityContentType.stories: - type_string = "Stories" - self.input_dto.director.constructStory(self.input_dto.story_builder, str(file), - self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations) - story = self.input_dto.story_builder.getObject() - Utils.add_id(self.ids, story, file) - self.output_dto.stories.append(story) - - elif type == SecurityContentType.detections: - type_string = "Detections" - self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, - self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines, - self.input_dto.attack_enrichment, self.output_dto.macros, - self.output_dto.lookups, self.input_dto.force_cached_or_offline) - detection = self.input_dto.detection_builder.getObject() - Utils.add_id(self.ids, detection, file) - self.output_dto.detections.append(detection) + elif type == SecurityContentType.stories: + type_string = "Stories" + self.input_dto.director.constructStory(self.input_dto.story_builder, str(file), + self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations) + story = self.input_dto.story_builder.getObject() + Utils.add_id(self.ids, story, file) + self.output_dto.stories.append(story) + + elif type == SecurityContentType.detections: + type_string = "Detections" + self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, + self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines, + self.input_dto.attack_enrichment, self.output_dto.macros, + self.output_dto.lookups, self.input_dto.force_cached_or_offline) + detection = self.input_dto.detection_builder.getObject() + Utils.add_id(self.ids, detection, file) + self.output_dto.detections.append(detection) - else: - raise Exception(f"Unsupported type: [{type}]") + else: + raise Exception(f"Unsupported type: [{type}]") + + if (sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()) or not already_ran: + already_ran = True + print(f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True) - if (sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()) or not already_ran: - already_ran = True - print(f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True) - - # except ValidationError as e: - # validation_errors.append((pathlib.Path(file), e)) - # except Exception as e: - # print(f"Unknown exception caught while Creating Security Content: {str(e)}") - # sys.exit(1) + except ValidationError as e: + validation_errors.append((pathlib.Path(file), e)) + except Exception as e: + print(f"Unknown exception caught while Creating Security Content: {str(e)}") + sys.exit(1) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 3b8f8d88c3..8736674239 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -28,6 +28,8 @@ class DetectionTags(BaseModel): risk_severity: str = None cve: list = None supported_tas: list = None + atomic_guid: list = None + drilldown_search: str = None # enrichment diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index c6ea5c68a3..7e02d55a7e 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -73,6 +73,10 @@ action.notable.param.rule_description = {{ detection.deployment.notable.rule_des action.notable.param.rule_title = {% if detection.type | lower == "correlation" %}RBA: {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% else %}{{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% endif +%} action.notable.param.security_domain = {{ detection.tags.security_domain }} action.notable.param.severity = high +{% if detection.tags.drilldown_search is not none %} +action.notable.param.drilldown_name = {{ detection.name }} +action.notable.param.drilldown_search = {{ detection.tags.drilldown_search }} +{% endif %} {% endif %} {% if detection.deployment.email.to is defined %} action.email.subject.alert = {{ detection.deployment.email.subject | custom_jinja2_enrichment_filter(detection) }} diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 5e655a8383..9cbca391e4 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -38,6 +38,9 @@ tags: - Living Off The Land asset_type: Endpoint confidence: 70 + drilldown_search: '| from datamodel:"Risk.All_Risk" + | search risk_object="$risk_object$" risk_object_type="$risk_object_type$" annotations.analytic_story="$annotations.analytic_story$" annotations.mitre_attack.mitre_tactic="$annotations.mitre_attack.mitre_tactic$" + | `get_correlations` | rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique' impact: 90 message: An increase of Living Off The Land behavior has been detected on $affected_systems$ mitre_attack_id: diff --git a/detections/web/hunting_for_log4shell.yml b/detections/web/hunting_for_log4shell.yml index c813489703..80e1d49d25 100644 --- a/detections/web/hunting_for_log4shell.yml +++ b/detections/web/hunting_for_log4shell.yml @@ -75,9 +75,7 @@ tags: - Log4Shell CVE-2021-44228 - CISA AA22-320A asset_type: Web Server - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 80 message: Hunting for Log4Shell exploitation has occurred. mitre_attack_id: diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 214ebaeae4..c440e00ea3 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index b83600fba8..240d7c38f4 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 0358a33a5a..aaec61e48d 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 7f161560ed..5469d593d9 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 26f0ac4aa4..5c7b766d5d 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -17517,7 +17517,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter` +search = `sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter` [ESCU - Drop IcedID License dat - Rule] action.escu = 0 @@ -17552,7 +17552,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter` +search = `sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter` [ESCU - DSQuery Domain Discovery - Rule] action.escu = 0 @@ -21240,7 +21240,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter` +search = `sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter` [ESCU - Impacket Lateral Movement Commandline Parameters - Rule] action.escu = 0 @@ -25344,6 +25344,8 @@ action.notable.param.rule_description = The following correlation identifies a d action.notable.param.rule_title = RBA: Living Off The Land action.notable.param.security_domain = endpoint action.notable.param.severity = high +action.notable.param.drilldown_name = Living Off The Land +action.notable.param.drilldown_search = | from datamodel:"Risk.All_Risk" | search risk_object="$risk_object$" risk_object_type="$risk_object_type$" annotations.analytic_story="$annotations.analytic_story$" annotations.mitre_attack.mitre_tactic="$annotations.mitre_attack.mitre_tactic$" | `get_correlations` | rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique alert.digest_mode = 1 disabled = true enableSched = 1 @@ -26103,7 +26105,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter` +search = `sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter` [ESCU - Modify ACL permission To Files Or Folder - Rule] action.escu = 0 @@ -26275,7 +26277,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter` +search = `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter` [ESCU - MS Scripting Process Loading WMI Module - Rule] action.escu = 0 @@ -26315,7 +26317,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter` +search = `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter` [ESCU - MSBuild Suspicious Spawned By Script Process - Rule] action.escu = 0 @@ -28379,7 +28381,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score='predicted(unusual_cmdline_logits)', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potentially_malicious_code_on_commandline_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score='predicted(unusual_cmdline_logits)', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potentially_malicious_code_on_commandline_filter` [ESCU - PowerShell 4104 Hunting - Rule] action.escu = 0 @@ -29111,7 +29113,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter` +search = `sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter` [ESCU - Powershell Remove Windows Defender Directory - Rule] action.escu = 0 @@ -36454,7 +36456,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` +search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` [ESCU - Wermgr Process Create Executable File - Rule] action.escu = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 5ff7f1fe2e..370496c3f8 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 6817c751d1..6c3415e724 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2023-01-04T12:58:29 UTC +# On Date: 2023-01-09T11:37:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml b/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml index 972b1e0703..478946af27 100644 --- a/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml +++ b/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Credential Dumping asset_type: Windows - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ diff --git a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index e230389ecc..77c82ceca1 100644 --- a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -51,9 +51,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Windows - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account diff --git a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 70036a7fa0..ff87984bae 100644 --- a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -52,9 +52,7 @@ tags: analytic_story: - Active Directory Lateral Movement asset_type: Windows - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account diff --git a/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml b/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml index b1ba836e3e..a6ff8a45c7 100644 --- a/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -55,9 +55,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ diff --git a/ssa_detections/deprecated/ssa___unusually_long_command_line.yml b/ssa_detections/deprecated/ssa___unusually_long_command_line.yml index 9ec216b3b5..ea3726af4a 100644 --- a/ssa_detections/deprecated/ssa___unusually_long_command_line.yml +++ b/ssa_detections/deprecated/ssa___unusually_long_command_line.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 40 - drilldown_search: [] impact: 30 message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index cfd5fc1ec7..a28e7c7146 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 30 - drilldown_search: [] impact: 20 message: Multiple interactive logins detected on $device$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 57d2debc8d..1b5fce8ee6 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -35,9 +35,7 @@ tags: - NOBELIUM Group - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index bccc679469..9a7b3f854c 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -37,9 +37,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index 05461585b7..4df76519f4 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -39,9 +39,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 4665e69eaf..3105633799 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$. diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index b81cc0c503..1b01cb0c2a 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -34,9 +34,7 @@ tags: - Ransomware - Information Sabotage asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 100 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability @@ -78,7 +76,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 3ba8cbced9..a1da58bf42 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -33,9 +33,7 @@ tags: - Ransomware - Information Sabotage asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors @@ -82,6 +80,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index d890c32669..16c7db3ccf 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -37,9 +37,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index b07454b941..82eee33114 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -35,9 +35,7 @@ tags: - XMRig - Information Sabotage asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___detect_kerberoasting.yml b/ssa_detections/endpoint/ssa___detect_kerberoasting.yml index 033f70e2c7..718e790d7e 100644 --- a/ssa_detections/endpoint/ssa___detect_kerberoasting.yml +++ b/ssa_detections/endpoint/ssa___detect_kerberoasting.yml @@ -33,9 +33,7 @@ tags: analytic_story: - Credential Dumping asset_type: Endpoint - atomic_guid: [] confidence: 20 - drilldown_search: [] impact: 70 message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 8ffb30fc74..39eeb03add 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -40,9 +40,7 @@ tags: - Suspicious Command-Line Executions - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event @@ -82,6 +80,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index f48357ac0c..67284180b3 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -46,9 +46,7 @@ tags: - Ransomware - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a @@ -90,6 +88,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml b/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml index 8add694806..6253025a3e 100644 --- a/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml +++ b/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml @@ -34,9 +34,7 @@ tags: analytic_story: - IcedID asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: Modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: @@ -65,9 +63,3 @@ tags: - Exploitation risk_score: 49 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index f508863e77..37ab1c1fe0 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -37,9 +37,7 @@ tags: - XMRig - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 304bfa585e..40442b4664 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -42,9 +42,7 @@ tags: - Data Exfiltration - Command and Control asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related @@ -86,6 +84,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml b/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml index 67453cc3e6..41d2c55ae1 100644 --- a/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml +++ b/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml @@ -28,9 +28,7 @@ tags: analytic_story: - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: High number of files copied mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___first_time_seen_command_line_argument.yml b/ssa_detections/endpoint/ssa___first_time_seen_command_line_argument.yml index b250a0831f..98595a59a2 100644 --- a/ssa_detections/endpoint/ssa___first_time_seen_command_line_argument.yml +++ b/ssa_detections/endpoint/ssa___first_time_seen_command_line_argument.yml @@ -43,9 +43,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 60 - drilldown_search: [] impact: 50 message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index ae12ac3fc8..9117683be4 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -36,9 +36,7 @@ tags: - Insider Threat - Information Sabotage asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file @@ -80,6 +78,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 4d4e9d1fa4..6334de9ed1 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -35,9 +35,7 @@ tags: - XMRig - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index aa1c0cfc56..231023330b 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -38,9 +38,7 @@ tags: - Information Sabotage - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. mitre_attack_id: @@ -71,6 +69,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml b/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml index 24c8733b8b..e6ae267a71 100644 --- a/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml +++ b/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml @@ -36,9 +36,7 @@ tags: - Clop Ransomware - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 90 message: High frequency file deletion activity detected on host $Computer$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 94029f0d71..6c79a8886a 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -38,9 +38,7 @@ tags: analytic_story: - XMRig asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index ec3a04598a..0112949f59 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious child process $process_name$ on host $dest$. @@ -79,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log + source: XmlWinEventLog update_timestamp: true diff --git a/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml b/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml index a9289cd407..21b45567e8 100644 --- a/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml +++ b/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml @@ -61,9 +61,7 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: Rare Parent-Child Process Relationship mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 7c0bf451e2..6fa651a428 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -37,9 +37,7 @@ tags: - Clop Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml index 596d43c515..bb16931acb 100644 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml @@ -47,9 +47,7 @@ tags: - Information Sabotage - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently delete files by $dest_user_id$. @@ -94,6 +92,5 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log + source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index bce5522505..fe61bcc993 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -237,9 +237,7 @@ tags: - Windows Defense Evasion Tactics - Masquerading - Rename System Utilities asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___unified_messaging_service_spawning_a_process.yml b/ssa_detections/endpoint/ssa___unified_messaging_service_spawning_a_process.yml index e5d67c3178..f97e8d6494 100644 --- a/ssa_detections/endpoint/ssa___unified_messaging_service_spawning_a_process.yml +++ b/ssa_detections/endpoint/ssa___unified_messaging_service_spawning_a_process.yml @@ -39,11 +39,9 @@ tags: - ProxyShell - ProxyNotShell asset_type: Endpoint - atomic_guid: [] confidence: 80 cve: - CVE-2021-26857 - drilldown_search: [] impact: 70 message: Possible CVE-2021-26857 exploitation on $dest$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index 50289a974a..d395c52c9a 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -36,9 +36,7 @@ tags: - Ryuk Ransomware - Ransomware asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 30 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 336875400e..cac469e2c2 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -41,9 +41,7 @@ tags: - Insider Threat - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index df0a3910f6..d316aa8939 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -37,9 +37,7 @@ tags: - Insider Threat - Information Sabotage asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index f7abf62937..496a73d2fd 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -46,9 +46,7 @@ tags: - BITS Jobs - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index e2e4b18207..6a6685e38c 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -49,9 +49,7 @@ tags: - DarkSide Ransomware - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $dest_user_id$ attempting to download a file. diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index 27c633dfff..7a1fdc8714 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -44,9 +44,7 @@ tags: - Deobfuscate-Decode Files or Information - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index a791f9fe81..fb1bc6ed42 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -41,9 +41,7 @@ tags: - DarkSide Ransomware - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index fa02e18214..d4835f865a 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -42,9 +42,7 @@ tags: - DarkSide Ransomware - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index f1ab2e96fe..8a71eb73d2 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ has spawned $process_name$ attempting to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 04af506d57..ba98881411 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -54,9 +54,7 @@ tags: - Ingress Tool Transfer - Insider Threat asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index a0a309f342..58e0b16ec1 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -30,9 +30,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Process $process_name$ with commandline $cmd_line$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index 6fdb575019..e28ef7f3d2 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 827d56be04..7450b937ec 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -61,9 +61,7 @@ tags: - Signed Binary Proxy Execution InstallUtil - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/ssa_detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml index 5f10b2a513..97d07cf119 100644 --- a/ssa_detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml +++ b/ssa_detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml @@ -43,9 +43,7 @@ tags: - IcedID - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index b9e1722d4f..23fa85b0f9 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -61,9 +61,7 @@ tags: - ProxyShell - CISA AA22-264A asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 40 message: Exchange enumeration using PowerShell on $dest_device_id$. mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 150dde16ae..b02949e250 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -44,11 +44,9 @@ tags: analytic_story: - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - atomic_guid: [] confidence: 100 cve: - CVE-2022-30190 - drilldown_search: [] impact: 100 message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution. diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index 6a6022d284..99d63d8cd5 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -39,9 +39,7 @@ tags: analytic_story: - DarkCrystal RAT asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 64a62e71cf..8628e09910 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -70,9 +70,7 @@ tags: - Ransomware - WhisperGate asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index 65fbd449ab..bf034303b7 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -40,9 +40,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index 0c85a948e5..627d9dc69f 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -42,9 +42,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index b021707d18..4aaf805038 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -40,9 +40,7 @@ tags: - Suspicious MSHTA Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index 5d275e2a7c..57f4a466ad 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -37,9 +37,7 @@ tags: analytic_story: - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 60 message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ attempting to circumvent controls. diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 31e9106511..b0abdf00f9 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -47,9 +47,7 @@ tags: - HAFNIUM Group - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 100 message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index 4ef6094637..93670c0d2f 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -44,9 +44,7 @@ tags: - Credential Dumping - HAFNIUM Group asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$. mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 8e94ee4ea2..e993e7f93a 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -49,9 +49,7 @@ tags: - HAFNIUM Group - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 2dae6375ca..53f6a0e5bb 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -39,9 +39,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 86861919c4..327575f1b4 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -38,9 +38,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks asset_type: endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 60 message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest_device_id$ mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 9434b03f58..6bf9f2958a 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -43,9 +43,7 @@ tags: - Ingress Tool Transfer - Log4Shell CVE-2021-44228 asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index b563c16494..e441b85ca8 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -41,9 +41,7 @@ tags: - BITS Jobs - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 70 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $dest_user_id$ attempting to download a file. diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 6ae1b3cedf..5c246d54eb 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -40,9 +40,7 @@ tags: - Windows Defense Evasion Tactics - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 9e119f973b..405bbffa4d 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index d04f582bdb..99e9038644 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index cbae163b10..f4f2648881 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -35,9 +35,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 7775ca999d..81eae7c5f9 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -35,9 +35,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 97529350b4..23f867f58d 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 4b16f3125d..adb093a4c3 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 51658a5302..b6942ae04f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -36,9 +36,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 4ab2ca2b33..55626bcc2e 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -35,9 +35,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 12b65fbe1e..7a9513a0fd 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -35,9 +35,7 @@ tags: - Unusual Processes - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 20 message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$ diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 24c37f8318..017228dede 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -32,9 +32,7 @@ tags: - Credential Dumping - Suspicious Rundll32 Activity asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 40 message: A dump of a process was attempted using comsvcs.dll with the minidump function on endpoint $dest_device_id$ by user $dest_device_user$. diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 0aea57e9d0..d3956a79c0 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -43,9 +43,7 @@ tags: - NOBELIUM Group - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 80 - drilldown_search: [] impact: 70 message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. mitre_attack_id: diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index efad2b8f1d..6f3f77d63a 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -40,9 +40,7 @@ tags: - Trusted Developer Utilities Proxy Execution MSBuild - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 41c0508b24..03b0ee38ee 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -39,9 +39,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 100 message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ under user $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 58c8fe350b..0ae998f0f8 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -48,9 +48,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 90 message: An instance of $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ contacting a remote destination. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 6ef40e81db..18749be1b5 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -51,9 +51,7 @@ tags: - Suspicious Compiled HTML Activity - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 80 message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest_device_id$ under user $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 2d91db0da0..69f3e0d9e5 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to register a file. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 838f78f87e..0cff3d5528 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 28bc9d016e..30c2cc3bb4 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -35,9 +35,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 70 message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to unregister a DLL. diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index f1b8748669..61683a69bf 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -41,9 +41,7 @@ tags: - Trusted Developer Utilities Proxy Execution MSBuild - Living Off The Land asset_type: Endpoint - atomic_guid: [] confidence: 100 - drilldown_search: [] impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$. diff --git a/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml b/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml index ebad2c64f6..3534547052 100644 --- a/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml +++ b/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml @@ -40,9 +40,7 @@ tags: - Living Off The Land - Windows Defense Evasion Tactics asset_type: Endpoint - atomic_guid: [] confidence: 90 - drilldown_search: [] impact: 70 message: tbd mitre_attack_id: diff --git a/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 03e54fedde..98b6bb0700 100644 --- a/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -36,9 +36,7 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 asset_type: endpoint - atomic_guid: [] confidence: 70 - drilldown_search: [] impact: 50 message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ diff --git a/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml b/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml index 2e083d3c86..d3bb528f7e 100644 --- a/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml +++ b/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml @@ -40,9 +40,7 @@ tags: analytic_story: - Insider Threat asset_type: endpoint - atomic_guid: [] confidence: 50 - drilldown_search: [] impact: 50 message: $src_device_ip downloaded unusually amount of data from internal server within one day From b32ec1ca07936ec0add74247fa56190775d5ec41 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 10 Jan 2023 12:14:26 +0100 Subject: [PATCH 7/7] fixed missing test files --- ...usual_number_of_failed_authentications_from_ip.yml | 7 +++++++ ...pted_credential_dump_from_registry_via_reg_exe.yml | 11 +++++++++++ detections/endpoint/bits_job_persistence.yml | 11 +++++++++++ detections/endpoint/bitsadmin_download_file.yml | 11 +++++++++++ detections/endpoint/creation_of_shadow_copy.yml | 11 +++++++++++ detections/endpoint/dump_lsass_via_procdump.yml | 11 +++++++++++ detections/endpoint/living_off_the_land.yml | 3 --- .../endpoint/windows_disable_memory_crash_dump.yml | 6 ++++++ .../windows_indirect_command_execution_via_pcalua.yml | 6 ++++++ 9 files changed, 74 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 68ed8ce149..7879170539 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -67,3 +67,10 @@ tags: - Splunk Cloud risk_score: 54 security_domain: access +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index a70c414c67..b7df11a0bb 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -63,3 +63,14 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 6b906a69bc..b9a8092158 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -68,3 +68,14 @@ tags: - Splunk Cloud risk_score: 56 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index b7e1ee5981..140a699864 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -74,3 +74,14 @@ tags: - Splunk Cloud risk_score: 49 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 7b17b8fe24..1d24b36a53 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -59,3 +59,14 @@ tags: - Splunk Cloud risk_score: 81 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 939a5bad5a..e05d67b4c4 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -69,3 +69,14 @@ tags: - Splunk Cloud risk_score: 80 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 9cbca391e4..5e655a8383 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -38,9 +38,6 @@ tags: - Living Off The Land asset_type: Endpoint confidence: 70 - drilldown_search: '| from datamodel:"Risk.All_Risk" - | search risk_object="$risk_object$" risk_object_type="$risk_object_type$" annotations.analytic_story="$annotations.analytic_story$" annotations.mitre_attack.mitre_tactic="$annotations.mitre_attack.mitre_tactic$" - | `get_correlations` | rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique' impact: 90 message: An increase of Living Off The Land behavior has been detected on $affected_systems$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 9e7eb21fc9..ebc52f4f11 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -70,3 +70,9 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 4ebecf9013..14c31271e8 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -46,3 +46,9 @@ tags: - Splunk Cloud risk_score: 25 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog