diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index 6f81151276..c271e9b7a1 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 0fe74c1bec..7808f8c6c0 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -85,6 +85,8 @@ stories: url: /stories/cloud_security/ - title: Malware url: /stories/malware/ + - title: Privilege Escalation + url: /stories/privilege_escalation/ - title: Vulnerability url: /stories/vulnerability/ playbooks: diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 49496d4d0a..f4eb63a047 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -60,8 +60,8 @@ sidebar: | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | @@ -589,6 +589,7 @@ sidebar: | [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP | | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | @@ -599,6 +600,7 @@ sidebar: | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Java Classes]() | None | Anomaly | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | @@ -615,6 +617,7 @@ sidebar: | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | diff --git a/docs/_pages/privilege_escalation.md b/docs/_pages/privilege_escalation.md index 60bde4562d..234c9e8c36 100644 --- a/docs/_pages/privilege_escalation.md +++ b/docs/_pages/privilege_escalation.md @@ -3,7 +3,11 @@ title: Privilege Escalation layout: tag author_profile: false taxonomy: Privilege Escalation -permalink: /detections/privilege_escalation/ +permalink: /stories/privilege_escalation/ sidebar: - nav: "detections" ---- \ No newline at end of file + nav: "stories" +--- + +| Name | Technique | Tactic | +| ----------- | ----------- |--------------| +| [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 118f12121b..b3dfe3c717 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -116,4 +116,5 @@ sidebar: | [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | -| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md index 8cfcdde7fa..cdfc5924d6 100644 --- a/docs/_playbooks/delete_detected_files.md +++ b/docs/_playbooks/delete_detected_files.md @@ -719,6 +719,9 @@ This playbook acts upon events where a file has been determined to be malicious + + + diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md index dfffa5f799..a6b8404eb9 100644 --- a/docs/_playbooks/log4j_investigate.md +++ b/docs/_playbooks/log4j_investigate.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md index d54e6d630a..e481f99c95 100644 --- a/docs/_playbooks/log4j_respond.md +++ b/docs/_playbooks/log4j_respond.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index 0299c811e8..bdea3a0823 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -723,6 +723,9 @@ This playbook investigates and contains ransomware detected on endpoints. + + + diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index fdf9fa20c5..e764528022 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 546b572f60..4b1d45805d 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index e12d68de5b..98bb689ec4 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index ab0ecc5637..a3fa6ef07a 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index bcf8aaaa8c..73b559cdc7 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 8fad54eb25..8899aeda49 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 4ad2e5b52c..abed4f537e 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 84e6a6e56c..21106203ab 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 656f58f772..fa905cff49 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 27c4ea999a..09dc3ce7c3 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 16f6591cd9..5d22e8600c 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 74be8d82f7..abed6c2a30 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 3c89f71481..88fc78ffb0 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index abe9c62ba4..2a41671e6e 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index c04d5022e3..4a13cb8743 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 305b0d96c0..b04d22b896 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 57e387f1b3..c27131ec6a 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 8eb6dcb7b4..5c1c79a22a 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index a3a7ff4fe0..d36385034a 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 93b66ac79b..d87eabc15e 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index e45ef8fd13..ec3d1540dd 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 2324a3c081..aa4c2545d7 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index c3a899224e..6010dd78b3 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 5497d10313..293057b6dc 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 52e81731e8..9f200d7288 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index b2b1612b06..4f92e207a9 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 648c5ac70a..a95ffd32d0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 342fdf976a..4a01d6ad31 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index e9f3b6a2de..4cff77757a 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 21755982a6..058d1e5dd2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index c47e24c064..aa48878684 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index aea0b66924..e410b32710 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 34dfdef967..29b6e7695d 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index fad1b4da69..4243de923a 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 6cec018769..6b57e1ce33 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index efe6426756..624c2d8604 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 587c321922..806cae541f 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index a3971be906..e8872dea56 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index f59439128a..6697097663 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 0df2e3e9a4..39b435b5c4 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 125925f8ea..e777a22344 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 76df51567f..c5149bfbd1 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index f86000429d..7b6ba38e2d 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index b398487cf2..2b11dab2f3 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 59b32e13bd..7e3331fa29 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 011f47bf11..254dd5dbe6 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index adc98ba3e1..a4a8b0c526 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 6d7527892e..48c07da8a6 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 05f075aa32..319f266239 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 46c91e5864..76f7a54e6b 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index abb6589d8a..16c6922284 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 657c0693e1..24ded7a654 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 4bde5a0a93..838528a2a2 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index ac098cfc58..01fafd1994 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index de3b6f6ff7..20e9574cf7 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index ec5164abee..757bd609ee 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 251c22c45c..a2fb8275c0 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index e725754cc4..9691fa9609 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 6b5f9a566d..0efdd8f5bb 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 88ae2f4a2f..857e9c0cae 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 66e0cb61d7..0659c04bd2 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index f0740c07c0..c6c44c174b 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 09b0d44813..aabb178903 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 6ca47d8477..febc2c7941 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 898b1cb5bc..ced5f95abd 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 0cf62cb13a..0e8a26cbc6 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 00e0f786ad..27938a0379 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index cd75dc755b..bf41d76542 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index c69b147120..821224f83e 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 17ff1b5612..cc58a00d98 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 0c0afb318c..ccf3405111 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index fb54f9013b..558b8295ef 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 0cf36a0a0d..6ccc7e0c57 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 6486c00bc7..08099e1d3c 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 2cc469a351..28c41121b8 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 4dd1b87f8a..6830c99a27 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 84fc83f605..d80392e8c0 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 72570dc4fa..04c0c6f028 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index dbadb9f1d6..6ea9194963 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 112b57d434..99cff9d716 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index b447f0ff1b..e652e13a6f 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index b91ddbe8de..05cdbd8a88 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 332ddfc58c..88b4e9883e 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index ed5ee31894..f204dc8f9a 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 2c97d73e16..4a129773da 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 4a5e3f7198..bf387af096 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 22dfe0d5f6..56ec8ce0e8 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 5af1e40a1a..612df1337e 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -97,7 +97,7 @@ False positives may be present and filtering will need to occur by parent proces | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 50038aa3aa..93e02ebeed 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 1f3b635fde..34197f534e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 1eb10f9491..b14393b1f9 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 2ce86bfe2a..4408e2f45b 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 714b87b24c..c42bfcd7cd 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md index 277f4092b4..058e672ada 100644 --- a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md @@ -98,7 +98,7 @@ Legitimate process can have this combination of command-line options, but it' | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 96af2320bc..ece38cfeb0 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index d6165d454a..9610e848a8 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 220322b755..d37e705f32 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 5979cf17df..379c80715c 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index e5ad7cad7b..9c198f7cd6 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 68d8b11af7..e75547efe1 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 2428fde8c9..977af1e228 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 76f3fe49d6..a32955e614 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md index 38a0bc3e33..29f3d586dd 100644 --- a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md @@ -94,7 +94,7 @@ False positives may be high based on legitimate scripted code in any environment | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 90dc422735..345cff8038 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -89,7 +89,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 817a87316a..d567c1cb8b 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -86,7 +86,7 @@ Filtering may be required in some instances, filter as needed. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 671785d68d..4f14ea95b4 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 7e4615d7d1..a5c516bf66 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -97,7 +97,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 1f9dadbed2..3e585f0ac3 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -103,7 +103,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 34e66801b5..a4da3cde5b 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -40,10 +40,16 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Search ``` - `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389 OR DestinationPort=1389 OR DestinationPort = 1099 ) -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter` ``` @@ -56,12 +62,15 @@ To successfully implement this search you need to be ingesting information on pr #### Required field * _time -* process_name -* EventID -* CommandLine -* Computer -* DestinationPort -* DestinationIp +* Processes.process_guid +* Processes.process_name +* Processes.dest +* Processes.process_path +* Processes.process +* Processes.parent_process_name +* Ports.process_guid +* Ports.dest +* Ports.dest_port #### Kill Chain Phase @@ -84,7 +93,7 @@ Legitimate Java applications may use perform outbound connections to these ports | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | @@ -99,7 +108,7 @@ Legitimate Java applications may use perform outbound connections to these ports Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) -* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log) +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log) diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 5a5e26df94..b443e3945b 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 01c4e9145c..b51cfa3f8c 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -201,7 +201,7 @@ It is highly possible you will find false positives, however, the base score is | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md new file mode 100644 index 0000000000..c50ba0c257 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -0,0 +1,117 @@ +--- +title: "Suspicious Computer Account Name Change" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer account names always end with `$`. This analytic leverages Event Id 4781, `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` +`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" +| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name +| `suspicious_computer_account_name_change_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. + +#### Required field +* _time +* EventCode +* ComputerName +* Account_Name +* Old_Account_Name +* New_Account_Name + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_computer_account_name_change.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md new file mode 100644 index 0000000000..c67b4e4ab7 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -0,0 +1,120 @@ +--- +title: "Suspicious Kerberos Service Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` EventCode=4769 +| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) +| where isSuspicious = 1 +| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious +| `suspicious_kerberos_service_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Service_Name +* Account_Name +* Client_Address +* Failure_Code + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md new file mode 100644 index 0000000000..d6d6c3df82 --- /dev/null +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -0,0 +1,111 @@ +--- +title: "Suspicious Ticket Granting Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-21 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-21 +- **Author**: Mauricio Velazco, Splunk +- **ID**: d77d349e-6269-11ec-9cfe-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$") +| eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) +| transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768) +| eval short_lived=case((duration<2),"TRUE") +| search short_lived = TRUE +| table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, short_lived +|`suspicious_ticket_granting_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Old_Account_Name +* New_Account_Name +* Account_Name +* ComputerName + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious TGT was requested was requested | + + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index 1bae69e6b5..dc36fe0040 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | diff --git a/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md new file mode 100644 index 0000000000..f0f76e3896 --- /dev/null +++ b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md @@ -0,0 +1,45 @@ +--- +title: "sAMAccountName Spoofing and Domain Controller Impersonation" +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 0244fdee-61be-11ec-900e-acde48001122 + +#### Narrative + +On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help help defenders identify attackers attempting exploitation. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | + +#### Reference + +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/index.markdown b/docs/index.markdown index 94ea7dcdae..60f02392ab 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -9,19 +9,19 @@ header: actions: - label: "Download" url: "https://splunkbase.splunk.com/app/3449/" -excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **696** detections for Splunk." +excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **699** detections for Splunk." feature_row: - image_path: /static/feature_detection.png alt: "customizable" title: "Detections" - excerpt: "See all **696** Splunk Analytics built to find evil 😈." + excerpt: "See all **699** Splunk Analytics built to find evil 😈." url: "/detections" btn_class: "btn--primary" btn_label: "Explore" - image_path: /static/feature_stories.png alt: "fully responsive" title: "Analytic Stories" - excerpt: "See all **107** use cases, 📦 of detections built to address a threat." + excerpt: "See all **108** use cases, 📦 of detections built to address a threat." url: "/stories" btn_class: "btn--primary" btn_label: "Explore"