From 5316ece6e02f05f087e4f8aa1fbbae1fb1fa7c8e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 15 Mar 2023 20:54:59 +0100 Subject: [PATCH] improvements ssa detections --- .../builder/sigma_converter.py | 2 +- .../ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 6 +++--- dist/ssa/srs/ssa___attempt_to_delete_services.yml | 2 +- ...ssa___clear_unallocated_sector_using_cipher_app.yml | 2 +- .../srs/ssa___deny_permission_using_cacls_utility.yml | 4 ++-- .../srs/ssa___grant_permission_using_cacls_utility.yml | 4 ++-- ...___hiding_files_and_directories_with_attrib_exe.yml | 2 +- ...a___office_product_spawning_windows_script_host.yml | 8 ++++---- dist/ssa/srs/ssa___windows_mshta_child_process.yml | 6 +++--- .../srs/ssa___windows_script_host_spawn_msbuild.yml | 4 ++-- dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- .../ssa___anomalous_usage_of_archive_tools.yml | 2 +- .../endpoint/ssa___attempt_to_delete_services.yml | 4 ++-- .../endpoint/ssa___attempt_to_disable_services.yml | 2 +- ...mpted_credential_dump_from_registry_via_reg_exe.yml | 2 +- .../ssa___bcdedit_failure_recovery_modification.yml | 2 +- ...ssa___clear_unallocated_sector_using_cipher_app.yml | 4 ++-- ssa_detections/endpoint/ssa___delete_a_net_user.yml | 2 +- .../ssa___deny_permission_using_cacls_utility.yml | 6 +++--- .../ssa___detect_rclone_command_line_usage.yml | 2 +- .../endpoint/ssa___disable_net_user_account.yml | 2 +- .../ssa___dns_exfiltration_using_nslookup_app.yml | 2 +- ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml | 2 +- .../ssa___grant_permission_using_cacls_utility.yml | 6 +++--- ...___hiding_files_and_directories_with_attrib_exe.yml | 4 ++-- ...sa___modify_acls_permission_of_files_or_folders.yml | 2 +- ...a___office_product_spawning_windows_script_host.yml | 10 +++++----- .../endpoint/ssa___resize_shadowstorage_volume.yml | 2 +- .../endpoint/ssa___sdelete_application_execution.yml | 2 +- ...system_process_running_from_unexpected_location.yml | 2 +- .../endpoint/ssa___wbadmin_delete_system_backups.yml | 2 +- .../endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- .../endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- .../endpoint/ssa___windows_bits_job_persistence.yml | 2 +- .../endpoint/ssa___windows_bitsadmin_download_file.yml | 2 +- .../endpoint/ssa___windows_certutil_decode_file.yml | 2 +- .../ssa___windows_certutil_urlcache_download.yml | 2 +- .../ssa___windows_certutil_verifyctl_download.yml | 2 +- ...ndows_com_hijacking_inprocserver32_modification.yml | 2 +- ...ssa___windows_curl_upload_to_remote_destination.yml | 2 +- ...a___windows_defender_tools_in_non_standard_path.yml | 2 +- .../ssa___windows_diskshadow_proxy_execution.yml | 2 +- ...sa___windows_dotnet_binary_in_non_standard_path.yml | 2 +- ...___windows_execute_arbitrary_commands_with_msdt.yml | 2 +- ...___windows_ingress_tool_transfer_using_explorer.yml | 2 +- ...sa___windows_lolbin_binary_in_non_standard_path.yml | 2 +- .../endpoint/ssa___windows_mshta_child_process.yml | 8 ++++---- .../endpoint/ssa___windows_mshta_command_line_url.yml | 2 +- .../ssa___windows_mshta_inline_hta_execution.yml | 2 +- .../ssa___windows_odbcconf_load_response_file.yml | 2 +- ...os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +- ...a___windows_os_credential_dumping_with_procdump.yml | 2 +- ...wershell_connect_to_internet_with_hidden_window.yml | 2 +- .../endpoint/ssa___windows_powershell_downloadfile.yml | 2 +- .../ssa___windows_powershell_start_bitstransfer.yml | 2 +- .../endpoint/ssa___windows_rasautou_dll_execution.yml | 2 +- ...acccheckconsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...ilities_advpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...s_agentexecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...es_appinstaller_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...aspnet_compiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...em_utilities_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...lities_atbroker_exe_lolbas_in_non_standard_path.yml | 2 +- .../ssa___windows_rundll32_comsvcs_memory_dump.yml | 2 +- .../ssa___windows_rundll32_inline_hta_execution.yml | 2 +- .../ssa___windows_script_host_spawn_msbuild.yml | 6 +++--- ...ry_proxy_execution_compiled_html_file_decompile.yml | 2 +- ...xecution_compiled_html_file_url_in_command_line.yml | 2 +- ...piled_html_file_using_infotech_storage_handlers.yml | 2 +- ...inary_proxy_execution_msiexec_dllregisterserver.yml | 2 +- ..._binary_proxy_execution_msiexec_remote_download.yml | 2 +- ...m_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +- .../endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml | 4 ++-- 75 files changed, 102 insertions(+), 102 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py b/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py index bd62702ca4..fc039dcd75 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py @@ -183,7 +183,7 @@ class SigmaConverter(): ) ) - detection = self.convert_detection_fields(detection, field_mapping) + detection = self.convert_detection_fields(detection, field_mapping_underline) sigma_rule = self.get_sigma_rule(detection, data_source) sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items) diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 73e91388ca..a3552f7c6d 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -7,8 +7,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) - | eval process_file_path=ucast(map_get(process_file,"path"), "string", + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), @@ -20,7 +20,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process.file.name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, + (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) | eval body=create_map( diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 50fd6fcad4..16aa46229e 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -23,7 +23,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") + like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 8591ebf6fa..30230c4535 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -21,7 +21,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") + like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 96cb6b8a63..6728e9dfcd 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -22,8 +22,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - AND match_regex(process_cmd_line, /(?i)deny/)=true + match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 11ded15884..f2247649af 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -22,8 +22,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - AND match_regex(process_cmd_line, /(?i)grant/)=true + match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index f28cf1e7a7..3228fc04a3 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -22,7 +22,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true + match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 0e2313fbe9..aa13968d1d 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -21,10 +21,10 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, - /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true - OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, - /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) + (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, + /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true + OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, + /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe") | eval body=create_map( "devices", [ diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index c4352bc49e..41c4131c82 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -22,11 +22,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" - OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe") - + OR process_file_name="powershell.exe") | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 0153e73804..ac817113d5 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -24,8 +24,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true - OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) + (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 6655a86ef1..b12f631e58 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -25,7 +25,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true + match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe" | eval body=create_map( "devices", [ diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 299e5f7d50..d6c8203ca9 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -26,7 +26,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process.file.name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, + (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index 46593a6ac6..d73f06402a 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") --finding_report--' + like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index 7038a03b40..d95a95130a 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 9bd3616529..c1e7fe8888 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 0fc1efabcd..aed9478fc7 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -54,7 +54,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 01232bc199..a67836a032 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -27,7 +27,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") --finding_report--' + like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -54,7 +54,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index 7800ccd9d3..02954b3727 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 86cf46b5f7..a92112b9e0 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -28,8 +28,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - AND match_regex(process_cmd_line, /(?i)deny/)=true --finding_report--' + match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -55,7 +55,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index b65f9570c5..4199c80766 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -66,7 +66,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index 49d6db7a3d..262a740c35 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -57,7 +57,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index ba04d42c8a..7cf489927d 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -62,7 +62,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index 561edd8183..0eb63b24fe 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -56,7 +56,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index a044ce6a39..a1c322a46d 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -28,8 +28,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - AND match_regex(process_cmd_line, /(?i)grant/)=true --finding_report--' + match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -55,7 +55,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index 75e7b334b1..bb0c437e60 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -28,7 +28,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--' + match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -57,7 +57,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 81a2c65715..b5431f655a 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index e3cb0a6da6..8df9bf6dca 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -27,10 +27,10 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, - /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true - OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, - /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) + (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, + /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true + OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, + /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -57,7 +57,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other - name: actor.process.file.name diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 971868db96..0332f16c00 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -57,7 +57,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml index 7904b73e1e..c196b01c70 100644 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml @@ -69,7 +69,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index e924369736..d7cda545f3 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -264,7 +264,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index ed6e03f0fe..9194e994ed 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -56,7 +56,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index a6a32dd284..5773e9e126 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -62,7 +62,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 62bc6ab0b2..c12b29c579 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index 7f7b8a7d43..a24ae0f8ac 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -65,7 +65,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 1d6a87c98d..d3bc359c7a 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -69,7 +69,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index 13a1637459..3eff69e316 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -64,7 +64,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index 411b5fc0f4..5d9b310add 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -60,7 +60,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index f7acc9e1f8..bb2a18e6b6 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -61,7 +61,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index 39b98cefba..d58c88722a 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -60,7 +60,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 1edd099121..fd711ddc32 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -72,7 +72,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index e7ddf7c123..e87347ce79 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -53,7 +53,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index e8f6cdb88e..5248dfcf9d 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -55,7 +55,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 9885fa57ab..e6fe86d551 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -98,7 +98,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 700e24580e..0420f71c20 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -64,7 +64,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index b81b785869..5dbd804468 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -58,7 +58,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 4be58a65d6..cd58ac59cb 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -95,7 +95,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index 53e4ecc402..7f3bd7a419 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -28,11 +28,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" - OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe") - --finding_report--' + OR process_file_name="powershell.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -61,7 +61,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other - name: actor.process.file.name diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index baf840909c..ffb3eae23a 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -63,7 +63,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 4f5b7107ef..5a30c411af 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -61,7 +61,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index 9a36180506..1ceac50e5b 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -57,7 +57,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 2f60612ab6..63d0fa2093 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -67,7 +67,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index 7ca5eca460..b56a254a5a 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -63,7 +63,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 4c0cf33a2c..d29c0618ce 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -70,7 +70,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 197ab0f14e..601171e7a3 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -64,7 +64,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 35dad0242a..94adead115 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -62,7 +62,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 96274f8a1c..692edf05f2 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -61,7 +61,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 80686c2a48..ae056994a0 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -61,7 +61,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5c1ef56ff5..f4f35c6b05 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 7e7573de39..dfbb6f056f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index e60df0e1b2..8b771d433f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 488fc3d360..ebfff6c34e 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -61,7 +61,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 24a38ca3b1..36fa051de5 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index f6f462f62e..b062070974 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 21ebca69af..4b20882bd1 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 65ee3ca7f8..ffef752255 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -60,7 +60,7 @@ tags: - name: process.file.path type: File - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 3142d45cdb..8b7af35b5b 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -55,7 +55,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 95e14ee82e..88713600d9 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -62,7 +62,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index d4a9694e7d..126ad471e1 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -30,8 +30,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true - OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--' + (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -60,7 +60,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other - name: actor.process.file.name diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 7d4ca946b7..55cfdcda57 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -59,7 +59,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 073d980790..4c4f00d779 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -68,7 +68,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index e437580929..3d3232ddb9 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -71,7 +71,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 19bf34db79..5c8f9cd840 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -54,7 +54,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index b20d4ad619..e0d3356871 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -54,7 +54,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 96bbc8a244..e10a5de7c6 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -54,7 +54,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other product: diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index 7b1209a8ee..e55a6ce12c 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -31,7 +31,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true + match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -61,7 +61,7 @@ tags: - name: device.hostname type: Hostname - name: process.file.name - type: File Name + type: File - name: process.cmd_line type: Other - name: actor.process.file.name