Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2024-05-08 10:16:28 -07:00
parent b6872b0b2e 59e85b0e1d
commit 61a3a7bf3e
926 changed files with 22674 additions and 19921 deletions
@@ -10,7 +10,7 @@ dist/DA-ESS-ContentUpdate-*.tar.gz
 dist/DA-ESS-ContentUpdate.tar.gz
 dist/ContentPack-*.appinspect_api_results.html
 dist/ContentPack-*.appinspect_api_results.json
-
+atomic-red-team/

 # IDE
 .vscode/
@@ -1,5 +1,5 @@
 default:
-  image: docker-hub.repo.splunkdev.net/python:3.9
+  image: docker-hub.repo.splunkdev.net/python:3.11

 variables:
  EXTRACTO_VERSION:
@@ -1,76 +1,89 @@
 {
-    // Use IntelliSense to learn about possible attributes.
-    // Hover to view descriptions of existing attributes.
-    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-    "version": "0.2.0",
    "configurations": [
        {
-            "name": "contentctl new_detection",
-            "type": "python",
+            "name": "contentctl init",
+            "type": "debugpy",
            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", ".", "new_content", "-t", "detection"]
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../ddd/",
+            "args": [
+                "init"
+            ]
        },
        {
            "name": "contentctl validate",
-            "type": "python",
+            "type": "debugpy",
            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", ".", "validate", "-pr", "ESCU"]
-        },
-        {
-            "name": "contentctl generate",
-            "type": "python",
-            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", ".", "generate", "-o", "dist/escu", "-pr", "ESCU"]
-        },
-        {
-            "name": "contentctl docgen",
-            "type": "python",
-            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", ".", "docgen", "-o", "docs"]
-        },
-        {
-            "name": "contentctl content_changer",
-            "type": "python",
-            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", "detections", "content_changer", "-cf", "fix_kill_chain"]
-        },
-        {
-            "name": "contentctl convert",
-            "type": "python",
-            "request": "launch",
-            "program": "${workspaceFolder}/contentctl.py",
-            "console": "integratedTerminal",
-            "justMyCode": true,
-            "args": ["-p", ".", "convert", "-dm", "ocsf", "-dp", "dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml", "-o", "ssa_detections/endpoint"]
-        },
-        {
-            "name": "Python: Current File",
-            "type": "python",
-            "request": "launch",
-            "program": "${file}",
-            "console": "integratedTerminal",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
            "args": [
-                "--path",
-                ".",
-                "--output",
-                "docs",
-                "-v"
+                "validate"
+            ]
+        },
+        {
+            "name": "contentctl validate enrich",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "validate",
+                "--enrichments"
+            ]
+        },
+        {
+            "name": "contentctl build",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "build"
+            ]
+        },
+        {
+            "name": "contentctl build enrich",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "build",
+                "--enrichments"
+            ]
+        },
+        {
+            "name": "contentctl test",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "test"
+            ]
+        },
+        {
+            "name": "contentctl --help",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "--help"
+            ]
+        },
+        {
+            "name": "contentctl test detection",
+            "type": "debugpy",
+            "request": "launch",
+            "program": "${workspaceFolder}/.venv/bin/contentctl",
+            "cwd": "${workspaceFolder}/../",
+            "args": [
+                "test",
+                "mode:selected",
+                "--mode.files",
+                "detections/endpoint/3cx_supply_chain_attack_network_indicators.yml"
            ]
        }
    ]
-}
+}
@@ -0,0 +1,7 @@
+# Splunk ES Content Update
+
+This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats.
+
+Requires Splunk Enterprise Security version 4.5 or greater.
+
+For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC).
@@ -0,0 +1,15 @@
+The Analytic Story Details dashboard renders all the details of the content related to a specific analytic story which
+can be chose via the drop down
+
+Each analytic story has attributes associated with it and the following:
+______________________________________________________________________
+
+
+	Analytic Story: name of the analytic story
+	Description	; description of the analytic story
+	Search Name	: The name of the searches belonging to the chosen analytic story
+	Search	: The search query which looks for an attack pattern corresponding to the analytic story
+	Search Description: The description of the search query
+	Asset Type: The analytic story specifies what asset in the infrastructure may be compromised
+	Category: The category that the search belongs to (malware, vulnerabilities, best practices, abuse)
+	Kill Chain Phase: The kill chain phase of the attack that the search is after.
@@ -0,0 +1,24 @@
+The ES_SOC Summary Dashboard provides you a summarized view of the analytic story contents of the ES-SOC app.
+The dashboard has the following panels gives you following details
+
+1) Analytic story Summary
+ 	- Total Analytic Stories : The total number of Analytic stories in the ES-SOC application
+ 	- Total Searches: The total number of searches in ES-SOC
+ 	- Searches added last week: Number of searches added to ES-SOC in the last week.
+
+ 2) Analytic story Category: This dashboard panel summarizes the categories of the searches that the ES-SOC app contains. The categories of the analytic stories are as follow
+  	-Malware: These searches detect specific malware behavior for a particular phase of the attack kill chain. E.g. a malware’s delivery method via email or a malware’s installation behavior via registry key changes
+  	-Vulnerability: These searches detect behavior or a signature of a vulnerable software in use. These searches are not designed to replace vulnerability management or scanning systems. The purpose of these searches is to discover a vulnerability through side effects or behaviors.
+  	-Abuse: Some actions can be deemed malicious because they are unexpected, violate corporate policy or are significantly different than the actions of other users. E.g. A USB disk that is seen on multiple systems or a user that uploads excessive files to a cloud service or a database query that dumps an entire table
+  	-Best Practices:  Searches that correspond to specific guidelines from organizations like SANS or OWASP
+
+ 3) Kill Chain phases: Every analytic story has one or more searches which look for a certain kind of attack pattern/behavior. These searches have an attribute which essentially tells you what Kill chain phase does the search correspond to.
+    The numbers on the dashboard represents the number of searches correponding to each kill chain phase
+
+ 4) Analytic story table: This table gives the user a comprehensive view of some of the details of the analytic story. Some of the listed attributes are:
+  	- Analytic Story : The name of the analytic story
+  	- Description: The description of the analyttic story
+  	- Search names: The name of the searches in each analytic story
+  	- Datamodels: The name of the datamodel that the search is querying against.
+  	- Technology Examples: This field represent some examples related to the technologies required to populate the datamodels(Nessues, Cisco Firewall,etc)
+  	- Kill chain phase: The name of the kill chain phase that the search belongs to
@@ -0,0 +1,51 @@
+######################
+ESSOC Usage Dashboard#
+######################
+
+The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table.
+
+IMPORTANT: The user loading this dashboard must have permission to search the _audit index
+
+##################
+#Dashboard panels#
+##################
+
+Searches Ran
+
+The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax
+
+Unique Searches
+
+The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app.
+
+Most Run
+
+The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Ad hoc Searches
+
+The total number of searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Scheduled
+
+The total number of ESSOC searches run that were scheduled.
+
+Most Active User
+
+The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Search Run Time (seconds)
+
+Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Average Run Time (seconds)
+
+Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Max Run Time (seconds)
+
+The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
+
+Search summary
+
+This table provides details on each search that was executed in the ESSOC app.
@@ -0,0 +1,2 @@
+### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
+### Using one single file analyticstories.conf that will be used both by ES and ESCU 
@@ -0,0 +1,31 @@
+## Splunk app configuration file
+
+[install]
+is_configured = false
+state = enabled
+state_change_requires_restart = false
+build = 16367
+
+[triggers]
+reload.analytic_stories = simple
+reload.usage_searches = simple
+reload.use_case_library = simple
+reload.correlationsearches = simple
+reload.analyticstories = simple
+reload.governance = simple
+reload.managed_configurations = simple
+reload.postprocess = simple
+reload.content-version = simple
+reload.es_investigations = simple
+
+[launcher]
+author = Splunk
+version = 4.9.0
+description = Explore the Analytic Stories included with ES Content Updates.
+
+[ui]
+is_visible = true
+label      = ES Content Updates
+
+[package]
+id = DA-ESS-ContentUpdate
@@ -0,0 +1,11 @@
+# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1
+#[dnstwist]
+#filename = dnstwist.py
+#chunked = true
+
+# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution'
+# [runstory]
+# filename = runstory.py
+# chunked = true
+# is_risky = true
+
@@ -0,0 +1,2 @@
+[content-version]
+version = 4.9.0
@@ -0,0 +1,7 @@
+<nav search_view="search" color="#65A637">
+  <view name="escu_summary" default="true"/>
+  <view name="feedback"/>
+  <view name="search"/>
+  <view name="dashboards"/>
+  <a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
+</nav>
@@ -0,0 +1,401 @@
+<dashboard version="2" theme="light">
+    <label>ESCU - AppLocker</label>
+    <description></description>
+    <definition><![CDATA[
+{
+    "dataSources": {
+        "ds_search_1_new_new": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker` \n| spath input=UserData_Xml path=RuleAndFileData.PolicyName output=PolicyName\n| spath input=UserData_Xml path=RuleAndFileData.RuleId output=RuleId\n| spath input=UserData_Xml path=RuleAndFileData.RuleName output=RuleName\n| spath input=UserData_Xml path=RuleAndFileData.RuleSddl output=RuleSddl\n| spath input=UserData_Xml path=RuleAndFileData.TargetUser output=TargetUser\n| spath input=UserData_Xml path=RuleAndFileData.TargetProcessId output=TargetProcessId\n| spath input=UserData_Xml path=RuleAndFileData.FilePath output=FilePath\n| spath input=UserData_Xml path=RuleAndFileData.Fqbn output=Fqbn\n| spath input=UserData_Xml path=RuleAndFileData.TargetLogonId output=TargetLogonId\n| spath input=UserData_Xml path=RuleAndFileData.FullFilePath output=FullFilePath\n| search PolicyName=*\n| table PolicyName, RuleId, RuleName, RuleSddl, TargetUser, TargetProcessId, FilePath, Fqbn, TargetLogonId, FullFilePath _time",
+                "queryParameters": {
+                    "earliest": "$global_time.earliest$",
+                    "latest": "$global_time.latest$"
+                }
+            }
+        },
+        "ds_search_1_new": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker`\n\n| eval EventType=case(\n    EventCode==8000, \"PolicyApplicationFailure\",\n    EventCode==8001, \"PolicyApplicationSuccess\",\n    EventCode==8002, \"AllowedFileExecution\",\n    EventCode==8003, \"AuditedFileExecution\",\n    EventCode==8004, \"BlockedFileExecution\",\n    EventCode==8005, \"AllowedScriptOrMSIExecution\",\n    EventCode==8006, \"AuditedScriptOrMSIExecution\",\n    EventCode==8007, \"BlockedScriptOrMSIExecution\",\n    EventCode==8020, \"AllowedPackagedApp\",\n    EventCode==8021, \"AuditedPackagedApp\",\n    EventCode==8022, \"DisabledPackagedApp\",\n    EventCode==8023, \"AllowedPackagedAppInstallation\",\n    EventCode==8024, \"AuditedPackagedAppInstallation\",\n    EventCode==8025, \"DisabledPackagedAppInstallation\",\n    EventCode==8027, \"NoPackagedAppRule\"\n)\n| table _time, host, EventCode, EventType\n| stats values(EventType) values(EventCode) count by host",
+                "queryParameters": {
+                    "earliest": "$global_time.earliest$",
+                    "latest": "$global_time.latest$"
+                }
+            },
+            "name": "eventcodereview"
+        },
+        "ds_search_1": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker`\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n|  search  PolicyName=$policyname$ EventCode=$eventcode$\n| stats values(host) AS dest by PolicyName, EventCode, Description, RuleId, RuleName, RuleSddl, TargetUser, TargetProcessId, FilePath, Fqbn, TargetLogonId, FullFilePath _time",
+                "queryParameters": {
+                    "earliest": "$global_time.earliest$",
+                    "latest": "$global_time.latest$"
+                }
+            },
+            "name": "policy_review"
+        },
+        "ds_YbLTfvcS": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker` EventCode IN (8007, 8004, 8022, 8025, 8029, 8040)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count",
+                "queryParameters": {
+                    "earliest": "$global_time.earliest$",
+                    "latest": "$global_time.latest$"
+                }
+            },
+            "name": "blocks"
+        },
+        "ds_h2Fcom6o": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker` EventCode IN (8003, 8006, 8021, 8024, 8039)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count"
+            },
+            "name": "Audit"
+        },
+        "ds_CAVvUpZ1": {
+            "type": "ds.search",
+            "options": {
+                "query": "`applocker` EventCode IN (8002, 8005, 8020, 8023, 8033, 8037)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count",
+                "queryParameters": {
+                    "earliest": "$global_time.earliest$",
+                    "latest": "$global_time.latest$"
+                }
+            },
+            "name": "allowed"
+        }
+    },
+    "visualizations": {
+        "viz_table_1_new": {
+            "type": "splunk.table",
+            "options": {
+                "count": 20,
+                "dataOverlayMode": "none",
+                "drilldown": "none",
+                "percentagesRow": false,
+                "rowNumbers": false,
+                "totalsRow": false,
+                "wrap": true
+            },
+            "dataSources": {
+                "primary": "ds_search_1_new"
+            },
+            "title": "EventCode Analysis"
+        },
+        "viz_table_1": {
+            "type": "splunk.table",
+            "options": {
+                "count": 20,
+                "dataOverlayMode": "none",
+                "drilldown": "none",
+                "percentagesRow": false,
+                "rowNumbers": false,
+                "totalsRow": false,
+                "wrap": true
+            },
+            "dataSources": {
+                "primary": "ds_search_1"
+            },
+            "title": "Policy Review"
+        },
+        "viz_oDemj4wG": {
+            "type": "splunk.markdown",
+            "options": {
+                "markdown": "## AppLocker Event Code Reference\n- `8000` - Policy Application Failure: Indicates a problem with applying the policy.\n- `8001` - Policy Application Success: The policy has been applied successfully.\n- `8002` - Allowed File Execution: A file was allowed to run.\n- `8003` - Audited File Execution: A file was executed and logged for audit purposes.\n- `8004` - Blocked File Execution: A file was blocked from running.\n- `8005` - Allowed Script Or MSI Execution: A script or MSI was allowed to run.\n- `8006` - Audited Script Or MSI Execution: A script or MSI was executed and logged for audit purposes.\n- `8007` - Blocked Script Or MSI Execution: A script or MSI was blocked from running.\n- `8020` - Allowed Packaged App: A packaged app was allowed to run.\n- `8021` - Audited Packaged App: A packaged app was executed and logged for audit purposes.\n- `8022` - Disabled Packaged App: A packaged app was disabled from running.\n- `8023` - Allowed Packaged App Installation: Installation of a packaged app was permitted.\n- `8024` - Audited Packaged App Installation: Installation of a packaged app was audited.\n- `8025` - Disabled Packaged App Installation: Installation of a packaged app was disabled.\n- `8027` - No Packaged App Rule: No applicable rule was found for a packaged app.\n"
+            }
+        },
+        "viz_7L8xsZTg": {
+            "type": "splunk.singlevalue",
+            "title": "Blocks",
+            "dataSources": {
+                "primary": "ds_YbLTfvcS"
+            }
+        },
+        "viz_hAZfweZe": {
+            "type": "splunk.singlevalue",
+            "dataSources": {
+                "primary": "ds_h2Fcom6o"
+            },
+            "title": "Audit"
+        },
+        "viz_xEjz65IP": {
+            "type": "splunk.singlevalue",
+            "title": "Allowed",
+            "dataSources": {
+                "primary": "ds_CAVvUpZ1"
+            }
+        }
+    },
+    "inputs": {
+        "input_global_trp": {
+            "type": "input.timerange",
+            "options": {
+                "token": "global_time",
+                "defaultValue": "-24h@h,now"
+            },
+            "title": "Global Time Range"
+        },
+        "input_7M6KtkjS": {
+            "options": {
+                "items": [
+                    {
+                        "label": "All",
+                        "value": "*"
+                    },
+                    {
+                        "label": "APPX",
+                        "value": "appx"
+                    },
+                    {
+                        "label": "SCRIPT",
+                        "value": "script"
+                    },
+                    {
+                        "label": "EXE",
+                        "value": "exe"
+                    },
+                    {
+                        "label": "DLL",
+                        "value": "dll"
+                    },
+                    {
+                        "label": "MSI",
+                        "value": "msi"
+                    }
+                ],
+                "token": "policyname",
+                "defaultValue": "*"
+            },
+            "title": "Select Policy Name",
+            "type": "input.dropdown"
+        },
+        "input_q9ZwkL2y": {
+            "options": {
+                "items": [
+                    {
+                        "label": "All",
+                        "value": "*"
+                    },
+                    {
+                        "label": "8000",
+                        "value": "8000"
+                    },
+                    {
+                        "label": "8001",
+                        "value": "8001"
+                    },
+                    {
+                        "label": "8002",
+                        "value": "8002"
+                    },
+                    {
+                        "label": "8003",
+                        "value": "8003"
+                    },
+                    {
+                        "label": "8004",
+                        "value": "8004"
+                    },
+                    {
+                        "label": "8005",
+                        "value": "8005"
+                    },
+                    {
+                        "label": "8006",
+                        "value": "8006"
+                    },
+                    {
+                        "label": "8007",
+                        "value": "8007"
+                    },
+                    {
+                        "label": "8008",
+                        "value": "8008"
+                    },
+                    {
+                        "label": "8020",
+                        "value": "8020"
+                    },
+                    {
+                        "label": "8021",
+                        "value": "8021"
+                    },
+                    {
+                        "label": "8022",
+                        "value": "8022"
+                    },
+                    {
+                        "label": "8023",
+                        "value": "8023"
+                    },
+                    {
+                        "label": "8024",
+                        "value": "8024"
+                    },
+                    {
+                        "label": "8025",
+                        "value": "8025"
+                    },
+                    {
+                        "label": "8027",
+                        "value": "8027"
+                    },
+                    {
+                        "label": "8028",
+                        "value": "8028"
+                    },
+                    {
+                        "label": "8029",
+                        "value": "8029"
+                    },
+                    {
+                        "label": "8030",
+                        "value": "8030"
+                    },
+                    {
+                        "label": "8031",
+                        "value": "8031"
+                    },
+                    {
+                        "label": "8032",
+                        "value": "8032"
+                    },
+                    {
+                        "label": "8033",
+                        "value": "8033"
+                    },
+                    {
+                        "label": "8034",
+                        "value": "8034"
+                    },
+                    {
+                        "label": "8035",
+                        "value": "8035"
+                    },
+                    {
+                        "label": "8036",
+                        "value": "8036"
+                    },
+                    {
+                        "label": "8037",
+                        "value": "8037"
+                    },
+                    {
+                        "label": "8038",
+                        "value": "8038"
+                    },
+                    {
+                        "label": "8039",
+                        "value": "8039"
+                    },
+                    {
+                        "label": "8040",
+                        "value": "8040"
+                    }
+                ],
+                "defaultValue": "*",
+                "token": "eventcode"
+            },
+            "title": "Select EventCode",
+            "type": "input.dropdown"
+        }
+    },
+    "layout": {
+        "type": "grid",
+        "options": {
+            "submitButton": true,
+            "submitOnDashboardLoad": true
+        },
+        "structure": [
+            {
+                "item": "viz_oDemj4wG",
+                "type": "block",
+                "position": {
+                    "x": 0,
+                    "y": 0,
+                    "w": 1200,
+                    "h": 179
+                }
+            },
+            {
+                "item": "viz_7L8xsZTg",
+                "type": "block",
+                "position": {
+                    "x": 0,
+                    "y": 179,
+                    "w": 300,
+                    "h": 168
+                }
+            },
+            {
+                "item": "viz_table_1",
+                "type": "block",
+                "position": {
+                    "x": 0,
+                    "y": 347,
+                    "w": 1200,
+                    "h": 682
+                }
+            },
+            {
+                "item": "viz_table_1_new",
+                "type": "block",
+                "position": {
+                    "x": 0,
+                    "y": 1029,
+                    "w": 1200,
+                    "h": 736
+                }
+            },
+            {
+                "item": "viz_hAZfweZe",
+                "type": "block",
+                "position": {
+                    "x": 300,
+                    "y": 179,
+                    "w": 300,
+                    "h": 168
+                }
+            },
+            {
+                "item": "viz_xEjz65IP",
+                "type": "block",
+                "position": {
+                    "x": 600,
+                    "y": 179,
+                    "w": 600,
+                    "h": 168
+                }
+            }
+        ],
+        "globalInputs": [
+            "input_global_trp",
+            "input_7M6KtkjS",
+            "input_q9ZwkL2y"
+        ]
+    },
+    "title": "ESCU - AppLocker",
+    "defaults": {
+        "dataSources": {
+            "ds.search": {
+                "options": {
+                    "queryParameters": {
+                        "latest": "$global_time.latest$",
+                        "earliest": "$global_time.earliest$"
+                    }
+                }
+            }
+        }
+    },
+    "description": "Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard."
+}
+    ]]></definition>
+    <meta type="hiddenElements"><![CDATA[
+{
+	"hideEdit": false,
+	"hideOpenInSearch": false,
+	"hideExport": false
+}
+    ]]></meta>
+</dashboard>
@@ -0,0 +1,193 @@
+<form theme="dark" version="1.1">
+  <label>Content Library</label>
+  <!-- Example uses stats transforming command -->
+  <!-- This limits evnts passed to post-process search -->
+  <title>Splunk Security Content</title>
+  <search id="baseSS">
+    <query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"</query>
+  </search>
+  <search id="baseAS">
+    <query>| rest /services/configs/conf-analyticstories splunk_server=local count=0 |search eai:acl.app = "DA-ESS-ContentUpdate"</query>
+  </search>
+  <init>
+    <set token="form.as_category">*</set>
+    <set token="form.detection">*</set>
+    <set token="form.as_story">*</set>
+    <set token="form.as_attack_id">*</set>
+  </init>
+  <!-- Rows for  Analytic Story Stats -->
+  <!-- Rows for  Analytic Story Table -->
+  <!-- Rows for  Search Stats -->
+  <fieldset submitButton="false"></fieldset>
+  <row>
+    <panel>
+      <html>
+        <h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
+      </html>
+    </panel>
+  </row>
+  <row id="analytic_stories_header_stats">
+    <panel>
+      <single>
+        <title>Total Analytic Stories</title>
+        <search base="baseAS">
+          <query> search title="analytic_story://*"  |stats count</query>
+        </search>
+        <!-- post-process search -->
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+      </single>
+    </panel>
+    <panel>
+      <single>
+        <title>Total Detections</title>
+        <search base="baseSS">
+          <query>stats count by action.correlationsearch.label|  eventstats sum(count) as total_detection_count|  fields total_detection_count</query>
+        </search>
+        <!-- post-process search -->
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+      </single>
+    </panel>
+    <panel>
+      <single>
+        <title>ESCU App Version</title>
+        <search id="version">
+          <query>| rest /services/configs/conf-content-version splunk_server=local count=0 | table version</query>
+        </search>
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+        <option name="refresh.display">progressbar</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+      </single>
+    </panel>
+  </row>
+  <row id="analytic_stories_viz">
+    <panel>
+      <title>Story Categories</title>
+      <chart>
+        <search>
+          <query>| rest /services/configs/conf-analyticstories splunk_server=local count=0 |  search eai:acl.app = "DA-ESS-ContentUpdate"|  search title="analytic_story://*"|  stats count by category</query>
+        </search>
+        <drilldown>
+          <set token="form.as_category">$click.value$</set>
+          <set token="as_category" prefix="&quot;" suffix="&quot;">$click.value$</set>
+        </drilldown>
+        <option name="charting.chart">bar</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="charting.axisLabelsX.integerUnits">true</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+      </chart>
+    </panel>
+    <panel>
+      <title>Analytic Stories by MITRE Technique ID</title>
+      <chart>
+        <search>
+          <query>
+                   | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" 
+|  spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" 
+|  spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name 
+ | stats dc(story_name) as "Analytic Stories" by "MITRE Technique ID"
+          </query>
+        </search>
+        <drilldown>
+          <set token="form.as_attack_id">$click.value$</set>
+          <set token="as_attack_id">$click.value$</set>
+        </drilldown>
+        <option name="charting.legend.placement">none</option>
+      </chart>
+    </panel>
+  </row>
+  <row id="analytic_stories_details_table">
+    <panel>
+      <input type="dropdown" token="story">
+        <label>Analytic Story</label>
+        <choice value="*">All</choice>
+        <search>
+          <latest>now</latest>
+          <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 
+|  search action.escu.search_type = detection 
+| spath input=action.correlationsearch.annotations path=analytic_story{} output="story" 
+|  mvexpand story
+| dedup story | fields story</query>
+        </search>
+        <fieldForLabel>story</fieldForLabel>
+        <fieldForValue>story</fieldForValue>
+        <default>*</default>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+        <initialValue>*</initialValue>
+      </input>
+      <html>
+            <input id="analytic_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
+        </html>
+      <table>
+        <title>Analytic Story Details</title>
+        <search>
+          <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 
+| search action.escu.search_type = detection 
+| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" 
+| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" 
+| spath input=action.escu.data_models path={} output="Data Models" 
+| rename title as "Detections" 
+| join  analytic_story 
+    [| rest /services/configs/conf-analyticstories splunk_server=local count=0 
+    | search title="analytic_story://*" 
+    | eval "analytic_story"=replace(title,"analytic_story://","" ) 
+        ] 
+| search analytic_story=  $story$
+|stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated"  by analytic_story description| rename analytic_story as "Analytic Story"| rename description as Description| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated"</query>
+          <earliest>$earliest$</earliest>
+          <latest>$latest$</latest>
+        </search>
+        <option name="count">5</option>
+        <option name="dataOverlayMode">none</option>
+        <option name="drilldown">row</option>
+        <option name="refresh.display">progressbar</option>
+        <option name="rowNumbers">true</option>
+        <option name="wrap">true</option>
+        <drilldown>
+          <link target="_blank">
+            <![CDATA[
+              /app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$row.Analytic Story$
+            ]]>
+          </link>
+        </drilldown>
+      </table>
+    </panel>
+  </row>
+</form>
@@ -0,0 +1,13 @@
+<form  isVisible="true" version="1.1">
+  <label>Feedback Center</label>
+  <description>Welcome to Splunk Enterprise Security Content Updates Feedback Center.</description>
+  <row>
+    <panel>
+      <html>
+        <p5>Contact us at <a href = "mailto:research@splunk.com">research@splunk.com</a> to send us support requests, bug reports, or questions directly to the Splunk Security Research Team.
+          <br>Please specify your request type and/or the title of any related Analytic Stories.</br>
+          You can also find us in the <b>#security-research</b> room in the <a href = "http://splunk-usergroups.slack.com/">Splunk Slack channel</a></p5>
+      </html>
+    </panel>
+  </row>
+</form>
@@ -0,0 +1,5 @@
+[replicationSettings:refineConf]
+replicate.analytic_stories = false
+
+[replicationBlacklist]
+excludeESCU = apps[/\\]DA-ESS-ContentUpdate[/\\]lookups[/\\]...
@@ -0,0 +1,73 @@
+[escu-metrics-usage]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+dispatchAs = user
+search = index=_audit sourcetype="audittrail" \
+"ESCU - "\
+`comment("Find all the search names in the audittrail.")`\
+| stats count(search) by search savedsearch_name user\
+| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
+`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
+| rex field=search "\"(?<savedsearch_name>.*)\""\
+`comment("Extract the name of the search from the search string")`\
+| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
+
+[escu-metrics-search]
+action.email.useNSSubject = 1
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+enableSched = 1
+cron_schedule = 0 0 * * *
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
+
+[escu-metrics-search-events]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+cron_schedule = 0 0 * * *
+enableSched = 1
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
+
+[escu-metrics-search-longest-runtime]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+enableSched = 1
+cron_schedule = 0 0 * * *
+disabled = 1
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
+
+[escu-metrics-usage-search]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+cron_schedule = 0 0 * * *
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+enableSched = 1
+dispatchAs = user
+search = index=_audit sourcetype="audittrail" \
+"ESCU - "\
+`comment("Find all the search names in the audittrail. Ignore the last few minutes so we can exclude this search's text from the result.")`\
+| stats count(search) by search savedsearch_name user\
+| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
+`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
+| rex field=search "\"(?<savedsearch_name>.*)\""\
+`comment("Extract the name of the search from the search string")`\
+| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
@@ -0,0 +1,2 @@
+### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
+### Using one single file analyticstories.conf that will be used both by ES and ESCU 
@@ -0,0 +1,638 @@
+mitre_id,technique,tactics,groups
+T1059.010,AutoHotKey & AutoIT,Execution,APT39
+T1564.012,File/Path Exclusions,Defense Evasion,no
+T1027.013,Encrypted/Encoded File,Defense Evasion,APT18|APT19|APT28|APT32|APT33|APT39|BITTER|Blue Mockingbird|Dark Caracal|Darkhotel|Elderwood|Fox Kitten|Group5|Higaisa|Inception|Lazarus Group|Leviathan|Magic Hound|Malteiro|Metador|Mofang|Molerats|Moses Staff|OilRig|Putter Panda|Sidewinder|TA2541|TA505|TeamTNT|Threat Group-3390|Transparent Tribe|Tropic Trooper|Whitefly|menuPass
+T1574.014,AppDomainManager,Defense Evasion|Persistence|Privilege Escalation,no
+T1584.008,Network Devices,Resource Development,APT28|Volt Typhoon
+T1548.006,TCC Manipulation,Defense Evasion|Privilege Escalation,no
+T1588.007,Artificial Intelligence,Resource Development,no
+T1218.015,Electron Applications,Defense Evasion,no
+T1543.005,Container Service,Persistence|Privilege Escalation,no
+T1665,Hide Infrastructure,Command And Control,APT29
+T1216.002,SyncAppvPublishingServer,Defense Evasion,no
+T1556.009,Conditional Access Policies,Credential Access|Defense Evasion|Persistence,Scattered Spider
+T1027.012,LNK Icon Smuggling,Defense Evasion,no
+T1036.009,Break Process Trees,Defense Evasion,no
+T1555.006,Cloud Secrets Management Stores,Credential Access,no
+T1016.002,Wi-Fi Discovery,Discovery,Magic Hound
+T1566.004,Spearphishing Voice,Initial Access,no
+T1598.004,Spearphishing Voice,Reconnaissance,LAPSUS$|Scattered Spider
+T1578.005,Modify Cloud Compute Configurations,Defense Evasion,no
+T1659,Content Injection,Command And Control|Initial Access,MoustachedBouncer
+T1564.011,Ignore Process Interrupts,Defense Evasion,no
+T1657,Financial Theft,Impact,Akira|Cinnamon Tempest|FIN13|Malteiro|Scattered Spider|SilverTerrier
+T1656,Impersonation,Defense Evasion,LAPSUS$|Scattered Spider
+T1567.004,Exfiltration Over Webhook,Exfiltration,no
+T1098.006,Additional Container Cluster Roles,Persistence|Privilege Escalation,no
+T1654,Log Enumeration,Discovery,APT5|Volt Typhoon
+T1548.005,Temporary Elevated Cloud Access,Defense Evasion|Privilege Escalation,no
+T1653,Power Settings,Persistence,no
+T1021.008,Direct Cloud VM Connections,Lateral Movement,no
+T1562.012,Disable or Modify Linux Audit System,Defense Evasion,no
+T1556.008,Network Provider DLL,Credential Access|Defense Evasion|Persistence,no
+T1652,Device Driver Discovery,Discovery,no
+T1027.011,Fileless Storage,Defense Evasion,APT32|Turla
+T1027.010,Command Obfuscation,Defense Evasion,APT19|APT32|Aquatic Panda|Chimera|Cobalt Group|Ember Bear|FIN6|FIN7|FIN8|Fox Kitten|GOLD SOUTHFIELD|Gamaredon Group|HEXANE|LazyScripter|Leafminer|Magic Hound|MuddyWater|Patchwork|Sandworm Team|Sidewinder|Silence|TA505|TA551|Turla|Wizard Spider
+T1562.011,Spoof Security Alerting,Defense Evasion,no
+T1552.008,Chat Messages,Credential Access,LAPSUS$
+T1651,Cloud Administration Command,Execution,APT29
+T1650,Acquire Access,Resource Development,no
+T1036.008,Masquerade File Type,Defense Evasion,Volt Typhoon
+T1567.003,Exfiltration to Text Storage Sites,Exfiltration,no
+T1583.008,Malvertising,Resource Development,Mustard Tempest
+T1021.007,Cloud Services,Lateral Movement,APT29|Scattered Spider
+T1205.002,Socket Filters,Command And Control|Defense Evasion|Persistence,no
+T1608.006,SEO Poisoning,Resource Development,Mustard Tempest
+T1027.009,Embedded Payloads,Defense Evasion,no
+T1027.008,Stripped Payloads,Defense Evasion,no
+T1556.007,Hybrid Identity,Credential Access|Defense Evasion|Persistence,APT29
+T1546.016,Installer Packages,Persistence|Privilege Escalation,no
+T1027.007,Dynamic API Resolution,Defense Evasion,Lazarus Group
+T1593.003,Code Repositories,Reconnaissance,LAPSUS$
+T1649,Steal or Forge Authentication Certificates,Credential Access,APT29
+T1070.009,Clear Persistence,Defense Evasion,no
+T1070.008,Clear Mailbox Data,Defense Evasion,no
+T1584.007,Serverless,Resource Development,no
+T1583.007,Serverless,Resource Development,no
+T1070.007,Clear Network Connection History and Configurations,Defense Evasion,Volt Typhoon
+T1556.006,Multi-Factor Authentication,Credential Access|Defense Evasion|Persistence,Scattered Spider
+T1586.003,Cloud Accounts,Resource Development,APT29
+T1585.003,Cloud Accounts,Resource Development,no
+T1648,Serverless Execution,Execution,no
+T1647,Plist File Modification,Defense Evasion,no
+T1622,Debugger Evasion,Defense Evasion|Discovery,no
+T1621,Multi-Factor Authentication Request Generation,Credential Access,APT29|LAPSUS$|Scattered Spider
+T1505.005,Terminal Services DLL,Persistence,no
+T1557.003,DHCP Spoofing,Collection|Credential Access,no
+T1059.009,Cloud API,Execution,APT29|TeamTNT
+T1595.003,Wordlist Scanning,Reconnaissance,APT41|Volatile Cedar
+T1098.005,Device Registration,Persistence|Privilege Escalation,APT29
+T1574.013,KernelCallbackTable,Defense Evasion|Persistence|Privilege Escalation,Lazarus Group
+T1556.005,Reversible Encryption,Credential Access|Defense Evasion|Persistence,no
+T1055.015,ListPlanting,Defense Evasion|Privilege Escalation,no
+T1564.010,Process Argument Spoofing,Defense Evasion,no
+T1564.009,Resource Forking,Defense Evasion,no
+T1559.003,XPC Services,Execution,no
+T1562.010,Downgrade Attack,Defense Evasion,no
+T1547.015,Login Items,Persistence|Privilege Escalation,no
+T1620,Reflective Code Loading,Defense Evasion,Lazarus Group
+T1619,Cloud Storage Object Discovery,Discovery,no
+T1218.014,MMC,Defense Evasion,no
+T1218.013,Mavinject,Defense Evasion,no
+T1614.001,System Language Discovery,Discovery,Ke3chang|Malteiro
+T1615,Group Policy Discovery,Discovery,Turla
+T1036.007,Double File Extension,Defense Evasion,Mustang Panda
+T1562.009,Safe Mode Boot,Defense Evasion,no
+T1564.008,Email Hiding Rules,Defense Evasion,FIN4|Scattered Spider
+T1505.004,IIS Components,Persistence,no
+T1027.006,HTML Smuggling,Defense Evasion,APT29
+T1213.003,Code Repositories,Collection,APT41|LAPSUS$|Scattered Spider
+T1553.006,Code Signing Policy Modification,Defense Evasion,APT39|Turla
+T1614,System Location Discovery,Discovery,SideCopy
+T1613,Container and Resource Discovery,Discovery,TeamTNT
+T1552.007,Container API,Credential Access,no
+T1612,Build Image on Host,Defense Evasion,no
+T1611,Escape to Host,Privilege Escalation,TeamTNT
+T1204.003,Malicious Image,Execution,TeamTNT
+T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
+T1610,Deploy Container,Defense Evasion|Execution,TeamTNT
+T1609,Container Administration Command,Execution,TeamTNT
+T1608.005,Link Target,Resource Development,LuminousMoth|Silent Librarian
+T1608.004,Drive-by Target,Resource Development,APT32|Dragonfly|FIN7|LuminousMoth|Mustard Tempest|Threat Group-3390|Transparent Tribe
+T1608.003,Install Digital Certificate,Resource Development,no
+T1608.002,Upload Tool,Resource Development,Threat Group-3390
+T1608.001,Upload Malware,Resource Development,APT32|BITTER|EXOTIC LILY|Earth Lusca|FIN7|Gamaredon Group|HEXANE|Kimsuky|LazyScripter|LuminousMoth|Mustang Panda|Mustard Tempest|SideCopy|TA2541|TA505|TeamTNT|Threat Group-3390
+T1608,Stage Capabilities,Resource Development,Mustang Panda
+T1016.001,Internet Connection Discovery,Discovery,APT29|FIN13|FIN8|Gamaredon Group|HAFNIUM|HEXANE|Magic Hound|TA2541|Turla
+T1553.005,Mark-of-the-Web Bypass,Defense Evasion,APT29|TA505
+T1555.005,Password Managers,Credential Access,Fox Kitten|LAPSUS$|Threat Group-3390
+T1484.002,Trust Modification,Defense Evasion|Privilege Escalation,Scattered Spider
+T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Cinnamon Tempest|Indrik Spider
+T1547.014,Active Setup,Persistence|Privilege Escalation,no
+T1606.002,SAML Tokens,Credential Access,no
+T1606.001,Web Cookies,Credential Access,no
+T1606,Forge Web Credentials,Credential Access,no
+T1555.004,Windows Credential Manager,Credential Access,OilRig|Stealth Falcon|Turla|Wizard Spider
+T1059.008,Network Device CLI,Execution,no
+T1602.002,Network Device Configuration Dump,Collection,no
+T1542.005,TFTP Boot,Defense Evasion|Persistence,no
+T1542.004,ROMMONkit,Defense Evasion|Persistence,no
+T1602.001,SNMP (MIB Dump),Collection,no
+T1602,Data from Configuration Repository,Collection,no
+T1601.002,Downgrade System Image,Defense Evasion,no
+T1601.001,Patch System Image,Defense Evasion,no
+T1601,Modify System Image,Defense Evasion,no
+T1600.002,Disable Crypto Hardware,Defense Evasion,no
+T1600.001,Reduce Key Space,Defense Evasion,no
+T1600,Weaken Encryption,Defense Evasion,no
+T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no
+T1599.001,Network Address Translation Traversal,Defense Evasion,no
+T1599,Network Boundary Bridging,Defense Evasion,no
+T1020.001,Traffic Duplication,Exfiltration,no
+T1557.002,ARP Cache Poisoning,Collection|Credential Access,Cleaver|LuminousMoth
+T1588.006,Vulnerabilities,Resource Development,Sandworm Team
+T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
+T1562.008,Disable or Modify Cloud Logs,Defense Evasion,APT29
+T1547.012,Print Processors,Persistence|Privilege Escalation,Earth Lusca
+T1598.003,Spearphishing Link,Reconnaissance,APT28|APT32|Dragonfly|Kimsuky|Magic Hound|Mustang Panda|Patchwork|Sandworm Team|Sidewinder|Silent Librarian|ZIRCONIUM
+T1598.002,Spearphishing Attachment,Reconnaissance,Dragonfly|SideCopy|Sidewinder
+T1598.001,Spearphishing Service,Reconnaissance,no
+T1598,Phishing for Information,Reconnaissance,APT28|Scattered Spider|ZIRCONIUM
+T1597.002,Purchase Technical Data,Reconnaissance,LAPSUS$
+T1597.001,Threat Intel Vendors,Reconnaissance,no
+T1597,Search Closed Sources,Reconnaissance,EXOTIC LILY
+T1596.005,Scan Databases,Reconnaissance,APT41
+T1596.004,CDNs,Reconnaissance,no
+T1596.003,Digital Certificates,Reconnaissance,no
+T1596.001,DNS/Passive DNS,Reconnaissance,no
+T1596.002,WHOIS,Reconnaissance,no
+T1596,Search Open Technical Databases,Reconnaissance,no
+T1595.002,Vulnerability Scanning,Reconnaissance,APT28|APT29|APT41|Aquatic Panda|Dragonfly|Earth Lusca|Magic Hound|Sandworm Team|TeamTNT|Volatile Cedar
+T1595.001,Scanning IP Blocks,Reconnaissance,TeamTNT
+T1595,Active Scanning,Reconnaissance,no
+T1594,Search Victim-Owned Websites,Reconnaissance,EXOTIC LILY|Kimsuky|Sandworm Team|Silent Librarian
+T1593.002,Search Engines,Reconnaissance,Kimsuky
+T1593.001,Social Media,Reconnaissance,EXOTIC LILY|Kimsuky
+T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team
+T1592.004,Client Configurations,Reconnaissance,HAFNIUM
+T1592.003,Firmware,Reconnaissance,no
+T1592.002,Software,Reconnaissance,Andariel|Magic Hound|Sandworm Team
+T1592.001,Hardware,Reconnaissance,no
+T1592,Gather Victim Host Information,Reconnaissance,no
+T1591.004,Identify Roles,Reconnaissance,HEXANE|LAPSUS$
+T1591.003,Identify Business Tempo,Reconnaissance,no
+T1591.001,Determine Physical Locations,Reconnaissance,Magic Hound
+T1591.002,Business Relationships,Reconnaissance,Dragonfly|LAPSUS$|Sandworm Team
+T1591,Gather Victim Org Information,Reconnaissance,Kimsuky|Lazarus Group
+T1590.006,Network Security Appliances,Reconnaissance,no
+T1590.005,IP Addresses,Reconnaissance,Andariel|HAFNIUM|Magic Hound
+T1590.004,Network Topology,Reconnaissance,FIN13
+T1590.003,Network Trust Dependencies,Reconnaissance,no
+T1590.002,DNS,Reconnaissance,no
+T1590.001,Domain Properties,Reconnaissance,Sandworm Team
+T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM
+T1589.003,Employee Names,Reconnaissance,APT41|Kimsuky|Sandworm Team|Silent Librarian
+T1589.002,Email Addresses,Reconnaissance,APT32|EXOTIC LILY|HAFNIUM|HEXANE|Kimsuky|LAPSUS$|Lazarus Group|Magic Hound|Sandworm Team|Silent Librarian|TA551
+T1589.001,Credentials,Reconnaissance,APT28|APT41|Chimera|LAPSUS$|Leviathan|Magic Hound
+T1589,Gather Victim Identity Information,Reconnaissance,APT32|FIN13|HEXANE|LAPSUS$|Magic Hound
+T1588.005,Exploits,Resource Development,Kimsuky
+T1588.004,Digital Certificates,Resource Development,BlackTech|Lazarus Group|LuminousMoth|Silent Librarian
+T1588.003,Code Signing Certificates,Resource Development,BlackTech|Ember Bear|FIN8|Threat Group-3390|Wizard Spider
+T1588.002,Tool,Resource Development,APT-C-36|APT1|APT19|APT28|APT29|APT32|APT33|APT38|APT39|APT41|Aoqin Dragon|Aquatic Panda|BITTER|BRONZE BUTLER|BackdoorDiplomacy|BlackTech|Blue Mockingbird|Carbanak|Chimera|Cinnamon Tempest|Cleaver|Cobalt Group|CopyKittens|DarkHydrus|DarkVishnya|Dragonfly|Earth Lusca|Ember Bear|FIN10|FIN13|FIN5|FIN6|FIN7|FIN8|Ferocious Kitten|GALLIUM|Gorgon Group|HEXANE|Inception|IndigoZebra|Ke3chang|Kimsuky|LAPSUS$|Lazarus Group|Leafminer|LuminousMoth|Magic Hound|Metador|Moses Staff|MuddyWater|POLONIUM|Patchwork|PittyTiger|Sandworm Team|Silence|Silent Librarian|TA2541|TA505|Threat Group-3390|Thrip|Turla|Volt Typhoon|WIRTE|Whitefly|Wizard Spider|menuPass
+T1588.001,Malware,Resource Development,APT1|Andariel|Aquatic Panda|BackdoorDiplomacy|Earth Lusca|LAPSUS$|LazyScripter|LuminousMoth|Metador|TA2541|TA505|Turla
+T1588,Obtain Capabilities,Resource Development,no
+T1587.004,Exploits,Resource Development,no
+T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM
+T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork
+T1587.001,Malware,Resource Development,APT29|Aoqin Dragon|Cleaver|FIN13|FIN7|Indrik Spider|Ke3chang|Kimsuky|Lazarus Group|LuminousMoth|Moses Staff|Sandworm Team|TeamTNT|Turla
+T1587,Develop Capabilities,Resource Development,Kimsuky
+T1586.002,Email Accounts,Resource Development,APT28|APT29|HEXANE|IndigoZebra|Kimsuky|LAPSUS$|Leviathan|Magic Hound
+T1586.001,Social Media Accounts,Resource Development,Leviathan|Sandworm Team
+T1586,Compromise Accounts,Resource Development,no
+T1585.002,Email Accounts,Resource Development,APT1|EXOTIC LILY|HEXANE|Indrik Spider|Kimsuky|Lazarus Group|Leviathan|Magic Hound|Mustang Panda|Sandworm Team|Silent Librarian|Wizard Spider
+T1585.001,Social Media Accounts,Resource Development,APT32|CURIUM|Cleaver|EXOTIC LILY|Fox Kitten|HEXANE|Kimsuky|Lazarus Group|Leviathan|Magic Hound|Sandworm Team
+T1585,Establish Accounts,Resource Development,APT17|Fox Kitten
+T1584.006,Web Services,Resource Development,Earth Lusca|Turla
+T1584.005,Botnet,Resource Development,Axiom|Sandworm Team
+T1584.004,Server,Resource Development,APT16|Dragonfly|Earth Lusca|Indrik Spider|Lazarus Group|Sandworm Team|Turla|Volt Typhoon
+T1584.003,Virtual Private Server,Resource Development,Turla
+T1584.002,DNS Server,Resource Development,LAPSUS$
+T1584.001,Domains,Resource Development,APT1|Kimsuky|Magic Hound|Mustard Tempest|SideCopy|Transparent Tribe
+T1583.006,Web Services,Resource Development,APT17|APT28|APT29|APT32|Confucius|Earth Lusca|FIN7|HAFNIUM|IndigoZebra|Kimsuky|Lazarus Group|LazyScripter|Magic Hound|MuddyWater|POLONIUM|TA2541|Turla|ZIRCONIUM
+T1583.005,Botnet,Resource Development,no
+T1583.004,Server,Resource Development,Earth Lusca|GALLIUM|Kimsuky|Mustard Tempest|Sandworm Team
+T1583.003,Virtual Private Server,Resource Development,APT28|Axiom|Dragonfly|HAFNIUM|LAPSUS$
+T1583.002,DNS Server,Resource Development,Axiom|HEXANE
+T1584,Compromise Infrastructure,Resource Development,no
+T1583.001,Domains,Resource Development,APT1|APT28|APT32|BITTER|Dragonfly|EXOTIC LILY|Earth Lusca|FIN7|Ferocious Kitten|Gamaredon Group|HEXANE|IndigoZebra|Kimsuky|Lazarus Group|LazyScripter|Leviathan|Magic Hound|Mustang Panda|Sandworm Team|Silent Librarian|TA2541|TA505|TeamTNT|Threat Group-3390|Transparent Tribe|Winnti Group|ZIRCONIUM|menuPass
+T1583,Acquire Infrastructure,Resource Development,Sandworm Team
+T1564.007,VBA Stomping,Defense Evasion,no
+T1558.004,AS-REP Roasting,Credential Access,no
+T1580,Cloud Infrastructure Discovery,Discovery,Scattered Spider
+T1218.012,Verclsid,Defense Evasion,no
+T1205.001,Port Knocking,Command And Control|Defense Evasion|Persistence,PROMETHIUM
+T1564.006,Run Virtual Instance,Defense Evasion,no
+T1564.005,Hidden File System,Defense Evasion,Equation|Strider
+T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no
+T1574.012,COR_PROFILER,Defense Evasion|Persistence|Privilege Escalation,Blue Mockingbird
+T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
+T1098.004,SSH Authorized Keys,Persistence|Privilege Escalation,Earth Lusca|TeamTNT
+T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
+T1059.007,JavaScript,Execution,APT32|Cobalt Group|Earth Lusca|Ember Bear|Evilnum|FIN6|FIN7|Higaisa|Indrik Spider|Kimsuky|LazyScripter|Leafminer|Molerats|MoustachedBouncer|MuddyWater|Sidewinder|Silence|TA505|Turla
+T1578.004,Revert Cloud Instance,Defense Evasion,no
+T1578.003,Delete Cloud Instance,Defense Evasion,LAPSUS$
+T1578.001,Create Snapshot,Defense Evasion,no
+T1578.002,Create Cloud Instance,Defense Evasion,LAPSUS$|Scattered Spider
+T1127.001,MSBuild,Defense Evasion,no
+T1027.005,Indicator Removal from Tools,Defense Evasion,APT3|Deep Panda|GALLIUM|OilRig|Patchwork|Turla
+T1562.006,Indicator Blocking,Defense Evasion,APT41|APT5
+T1573.002,Asymmetric Cryptography,Command And Control,Cobalt Group|FIN6|FIN8|OilRig|TA2541|Tropic Trooper
+T1573.001,Symmetric Cryptography,Command And Control,APT28|APT33|BRONZE BUTLER|Darkhotel|Higaisa|Inception|Lazarus Group|MuddyWater|Mustang Panda|Stealth Falcon|Volt Typhoon|ZIRCONIUM
+T1573,Encrypted Channel,Command And Control,APT29|BITTER|Magic Hound|Tropic Trooper
+T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|MuddyWater|Rocke
+T1574.004,Dylib Hijacking,Defense Evasion|Persistence|Privilege Escalation,no
+T1546.015,Component Object Model Hijacking,Persistence|Privilege Escalation,APT28
+T1071.004,DNS,Command And Control,APT18|APT39|APT41|Chimera|Cobalt Group|FIN7|Ke3chang|LazyScripter|OilRig|Tropic Trooper
+T1071.003,Mail Protocols,Command And Control,APT28|APT32|Kimsuky|SilverTerrier|Turla
+T1071.002,File Transfer Protocols,Command And Control,APT41|Dragonfly|Kimsuky|SilverTerrier
+T1071.001,Web Protocols,Command And Control,APT18|APT19|APT28|APT32|APT33|APT37|APT38|APT39|APT41|BITTER|BRONZE BUTLER|Chimera|Cobalt Group|Confucius|Dark Caracal|FIN13|FIN4|FIN8|Gamaredon Group|HAFNIUM|Higaisa|Inception|Ke3chang|Kimsuky|Lazarus Group|LuminousMoth|Magic Hound|Metador|MuddyWater|Mustang Panda|OilRig|Orangeworm|Rancor|Rocke|Sandworm Team|Sidewinder|SilverTerrier|Stealth Falcon|TA505|TA551|TeamTNT|Threat Group-3390|Tropic Trooper|Turla|WIRTE|Windshift|Wizard Spider
+T1572,Protocol Tunneling,Command And Control,Chimera|Cinnamon Tempest|Cobalt Group|FIN13|FIN6|Fox Kitten|Leviathan|Magic Hound|OilRig
+T1048.003,Exfiltration Over Unencrypted Non-C2 Protocol,Exfiltration,APT32|APT33|FIN6|FIN8|Lazarus Group|OilRig|Thrip|Wizard Spider
+T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28
+T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
+T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group
+T1001.002,Steganography,Command And Control,Axiom
+T1001.001,Junk Data,Command And Control,APT28
+T1132.002,Non-Standard Encoding,Command And Control,no
+T1132.001,Standard Encoding,Command And Control,APT19|APT33|BRONZE BUTLER|HAFNIUM|Lazarus Group|MuddyWater|Patchwork|Sandworm Team|TA551|Tropic Trooper
+T1090.004,Domain Fronting,Command And Control,APT29
+T1090.003,Multi-hop Proxy,Command And Control,APT28|APT29|FIN4|Inception|Leviathan
+T1090.002,External Proxy,Command And Control,APT28|APT29|APT3|APT39|FIN5|GALLIUM|Lazarus Group|MuddyWater|Silence|Tonto Team|menuPass
+T1090.001,Internal Proxy,Command And Control,APT39|FIN13|Higaisa|Lazarus Group|Strider|Turla|Volt Typhoon
+T1102.003,One-Way Communication,Command And Control,Leviathan
+T1102.002,Bidirectional Communication,Command And Control,APT12|APT28|APT37|APT39|Carbanak|FIN7|HEXANE|Kimsuky|Lazarus Group|Magic Hound|MuddyWater|POLONIUM|Sandworm Team|Turla|ZIRCONIUM
+T1102.001,Dead Drop Resolver,Command And Control,APT41|BRONZE BUTLER|Patchwork|RTM|Rocke
+T1571,Non-Standard Port,Command And Control,APT-C-36|APT32|APT33|DarkVishnya|FIN7|Lazarus Group|Magic Hound|Rocke|Sandworm Team|Silence|WIRTE
+T1074.002,Remote Data Staging,Collection,APT28|Chimera|FIN6|FIN8|Leviathan|MoustachedBouncer|Threat Group-3390|ToddyCat|menuPass
+T1074.001,Local Data Staging,Collection,APT28|APT3|APT39|APT5|BackdoorDiplomacy|Chimera|Dragonfly|FIN13|FIN5|GALLIUM|Indrik Spider|Kimsuky|Lazarus Group|Leviathan|MuddyWater|Mustang Panda|Patchwork|Sidewinder|TeamTNT|Threat Group-3390|Volt Typhoon|Wizard Spider|menuPass
+T1078.004,Cloud Accounts,Defense Evasion|Initial Access|Persistence|Privilege Escalation,APT28|APT29|APT33|APT5|Ke3chang|LAPSUS$
+T1564.004,NTFS File Attributes,Defense Evasion,APT32
+T1564.003,Hidden Window,Defense Evasion,APT19|APT28|APT3|APT32|CopyKittens|DarkHydrus|Deep Panda|Gamaredon Group|Gorgon Group|Higaisa|Kimsuky|Magic Hound|Nomadic Octopus|ToddyCat
+T1078.003,Local Accounts,Defense Evasion|Initial Access|Persistence|Privilege Escalation,APT29|APT32|FIN10|FIN7|HAFNIUM|Kimsuky|PROMETHIUM|Tropic Trooper|Turla
+T1078.002,Domain Accounts,Defense Evasion|Initial Access|Persistence|Privilege Escalation,APT3|APT5|Chimera|Cinnamon Tempest|Indrik Spider|Magic Hound|Naikon|Sandworm Team|TA505|Threat Group-1314|ToddyCat|Volt Typhoon|Wizard Spider
+T1078.001,Default Accounts,Defense Evasion|Initial Access|Persistence|Privilege Escalation,FIN13|Magic Hound
+T1564.002,Hidden Users,Defense Evasion,Dragonfly|Kimsuky
+T1574.006,Dynamic Linker Hijacking,Defense Evasion|Persistence|Privilege Escalation,APT41|Rocke
+T1574.002,DLL Side-Loading,Defense Evasion|Persistence|Privilege Escalation,APT19|APT3|APT32|APT41|BRONZE BUTLER|BlackTech|Chimera|Cinnamon Tempest|Earth Lusca|FIN13|GALLIUM|Higaisa|Lazarus Group|LuminousMoth|MuddyWater|Mustang Panda|Naikon|Patchwork|SideCopy|Sidewinder|Threat Group-3390|Tropic Trooper|menuPass
+T1574.001,DLL Search Order Hijacking,Defense Evasion|Persistence|Privilege Escalation,APT41|Aquatic Panda|BackdoorDiplomacy|Cinnamon Tempest|Evilnum|RTM|Threat Group-3390|Tonto Team|Whitefly|menuPass
+T1574.008,Path Interception by Search Order Hijacking,Defense Evasion|Persistence|Privilege Escalation,no
+T1574.007,Path Interception by PATH Environment Variable,Defense Evasion|Persistence|Privilege Escalation,no
+T1574.009,Path Interception by Unquoted Path,Defense Evasion|Persistence|Privilege Escalation,no
+T1574.011,Services Registry Permissions Weakness,Defense Evasion|Persistence|Privilege Escalation,no
+T1574.005,Executable Installer File Permissions Weakness,Defense Evasion|Persistence|Privilege Escalation,no
+T1574.010,Services File Permissions Weakness,Defense Evasion|Persistence|Privilege Escalation,no
+T1574,Hijack Execution Flow,Defense Evasion|Persistence|Privilege Escalation,no
+T1069.001,Local Groups,Discovery,Chimera|HEXANE|OilRig|Tonto Team|Turla|Volt Typhoon|admin@338
+T1570,Lateral Tool Transfer,Lateral Movement,APT32|APT41|Aoqin Dragon|Chimera|FIN10|GALLIUM|Magic Hound|Sandworm Team|Turla|Volt Typhoon|Wizard Spider
+T1568.003,DNS Calculation,Command And Control,APT12
+T1204.002,Malicious File,Execution,APT-C-36|APT12|APT19|APT28|APT29|APT30|APT32|APT33|APT37|APT38|APT39|Ajax Security Team|Andariel|Aoqin Dragon|BITTER|BRONZE BUTLER|BlackTech|CURIUM|Cobalt Group|Confucius|Dark Caracal|DarkHydrus|Darkhotel|Dragonfly|EXOTIC LILY|Earth Lusca|Elderwood|Ember Bear|FIN4|FIN6|FIN7|FIN8|Ferocious Kitten|Gallmaker|Gamaredon Group|Gorgon Group|HEXANE|Higaisa|Inception|IndigoZebra|Indrik Spider|Kimsuky|Lazarus Group|LazyScripter|Leviathan|Machete|Magic Hound|Malteiro|Mofang|Molerats|MuddyWater|Mustang Panda|Naikon|Nomadic Octopus|OilRig|PLATINUM|PROMETHIUM|Patchwork|RTM|Rancor|Sandworm Team|SideCopy|Sidewinder|Silence|TA2541|TA459|TA505|TA551|The White Company|Threat Group-3390|Tonto Team|Transparent Tribe|Tropic Trooper|WIRTE|Whitefly|Windshift|Wizard Spider|admin@338|menuPass
+T1204.001,Malicious Link,Execution,APT28|APT29|APT3|APT32|APT33|APT39|BlackTech|Cobalt Group|Confucius|EXOTIC LILY|Earth Lusca|Elderwood|Ember Bear|Evilnum|FIN4|FIN7|FIN8|Kimsuky|LazyScripter|Leviathan|LuminousMoth|Machete|Magic Hound|Mofang|Molerats|MuddyWater|Mustang Panda|Mustard Tempest|OilRig|Patchwork|Sandworm Team|Sidewinder|TA2541|TA505|Transparent Tribe|Turla|Windshift|Wizard Spider|ZIRCONIUM
+T1195.003,Compromise Hardware Supply Chain,Initial Access,no
+T1195.002,Compromise Software Supply Chain,Initial Access,APT41|Cobalt Group|Dragonfly|FIN7|GOLD SOUTHFIELD|Sandworm Team|Threat Group-3390
+T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
+T1568.001,Fast Flux DNS,Command And Control,TA505|menuPass
+T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper
+T1569.002,Service Execution,Execution,APT32|APT38|APT39|APT41|Blue Mockingbird|Chimera|FIN6|Ke3chang|Silence|Wizard Spider
+T1569.001,Launchctl,Execution,no
+T1569,System Services,Execution,TeamTNT
+T1568.002,Domain Generation Algorithms,Command And Control,APT41|TA551
+T1568,Dynamic Resolution,Command And Control,APT29|BITTER|Gamaredon Group|TA2541|Transparent Tribe
+T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
+T1567.002,Exfiltration to Cloud Storage,Exfiltration,Akira|Chimera|Cinnamon Tempest|Confucius|Earth Lusca|FIN7|HAFNIUM|HEXANE|Kimsuky|Leviathan|LuminousMoth|POLONIUM|Scattered Spider|Threat Group-3390|ToddyCat|Turla|Wizard Spider|ZIRCONIUM
+T1567.001,Exfiltration to Code Repository,Exfiltration,no
+T1059.006,Python,Execution,APT29|APT37|APT39|BRONZE BUTLER|Cinnamon Tempest|Dragonfly|Earth Lusca|Kimsuky|Machete|MuddyWater|Rocke|Tonto Team|Turla|ZIRCONIUM
+T1059.005,Visual Basic,Execution,APT-C-36|APT32|APT33|APT37|APT38|APT39|BRONZE BUTLER|Cobalt Group|Confucius|Earth Lusca|FIN13|FIN4|FIN7|Gamaredon Group|Gorgon Group|HEXANE|Higaisa|Inception|Kimsuky|Lazarus Group|LazyScripter|Leviathan|Machete|Magic Hound|Malteiro|Molerats|MuddyWater|Mustang Panda|OilRig|Patchwork|Rancor|Sandworm Team|SideCopy|Sidewinder|Silence|TA2541|TA459|TA505|Transparent Tribe|Turla|WIRTE|Windshift
+T1059.004,Unix Shell,Execution,APT41|Rocke|TeamTNT
+T1059.003,Windows Command Shell,Execution,APT1|APT18|APT28|APT3|APT32|APT37|APT38|APT41|APT5|Aquatic Panda|BRONZE BUTLER|Blue Mockingbird|Chimera|Cinnamon Tempest|Cobalt Group|Dark Caracal|Darkhotel|Dragonfly|Ember Bear|FIN10|FIN13|FIN6|FIN7|FIN8|Fox Kitten|GALLIUM|Gamaredon Group|Gorgon Group|HAFNIUM|Higaisa|Indrik Spider|Ke3chang|Kimsuky|Lazarus Group|LazyScripter|Machete|Magic Hound|Metador|MuddyWater|Mustang Panda|Nomadic Octopus|OilRig|Patchwork|Rancor|Silence|Sowbug|Suckfly|TA505|TA551|TeamTNT|Threat Group-1314|Threat Group-3390|ToddyCat|Tropic Trooper|Turla|Volt Typhoon|Wizard Spider|ZIRCONIUM|admin@338|menuPass
+T1059.002,AppleScript,Execution,no
+T1059.001,PowerShell,Execution,APT19|APT28|APT29|APT3|APT32|APT33|APT38|APT39|APT41|APT5|Aquatic Panda|BRONZE BUTLER|Blue Mockingbird|Chimera|Cinnamon Tempest|Cobalt Group|Confucius|CopyKittens|DarkHydrus|DarkVishnya|Deep Panda|Dragonfly|Earth Lusca|Ember Bear|FIN10|FIN13|FIN6|FIN7|FIN8|Fox Kitten|GALLIUM|GOLD SOUTHFIELD|Gallmaker|Gamaredon Group|Gorgon Group|HAFNIUM|HEXANE|Inception|Indrik Spider|Kimsuky|Lazarus Group|LazyScripter|Leviathan|Magic Hound|Molerats|MoustachedBouncer|MuddyWater|Mustang Panda|Nomadic Octopus|OilRig|Patchwork|Poseidon Group|Sandworm Team|Sidewinder|Silence|Stealth Falcon|TA2541|TA459|TA505|TeamTNT|Threat Group-3390|Thrip|ToddyCat|Tonto Team|Turla|Volt Typhoon|WIRTE|Wizard Spider|menuPass
+T1567,Exfiltration Over Web Service,Exfiltration,APT28|Magic Hound
+T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
+T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7
+T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|OilRig|Volt Typhoon
+T1498.002,Reflection Amplification,Impact,no
+T1498.001,Direct Network Flood,Impact,no
+T1566.003,Spearphishing via Service,Initial Access,APT29|Ajax Security Team|CURIUM|Dark Caracal|EXOTIC LILY|FIN6|Lazarus Group|Magic Hound|OilRig|ToddyCat|Windshift
+T1566.002,Spearphishing Link,Initial Access,APT1|APT28|APT29|APT3|APT32|APT33|APT39|BlackTech|Cobalt Group|Confucius|EXOTIC LILY|Earth Lusca|Elderwood|Ember Bear|Evilnum|FIN4|FIN7|FIN8|Kimsuky|Lazarus Group|LazyScripter|Leviathan|LuminousMoth|Machete|Magic Hound|Mofang|Molerats|MuddyWater|Mustang Panda|Mustard Tempest|OilRig|Patchwork|Sandworm Team|Sidewinder|TA2541|TA505|Transparent Tribe|Turla|Windshift|Wizard Spider|ZIRCONIUM
+T1566.001,Spearphishing Attachment,Initial Access,APT-C-36|APT1|APT12|APT19|APT28|APT29|APT30|APT32|APT33|APT37|APT38|APT39|APT41|Ajax Security Team|Andariel|BITTER|BRONZE BUTLER|BlackTech|Cobalt Group|Confucius|DarkHydrus|Darkhotel|Dragonfly|EXOTIC LILY|Elderwood|Ember Bear|FIN4|FIN6|FIN7|FIN8|Ferocious Kitten|Gallmaker|Gamaredon Group|Gorgon Group|Higaisa|Inception|IndigoZebra|Kimsuky|Lazarus Group|LazyScripter|Leviathan|Machete|Malteiro|Mofang|Molerats|MuddyWater|Mustang Panda|Naikon|Nomadic Octopus|OilRig|PLATINUM|Patchwork|RTM|Rancor|Sandworm Team|SideCopy|Sidewinder|Silence|TA2541|TA459|TA505|TA551|The White Company|Threat Group-3390|Tonto Team|Transparent Tribe|Tropic Trooper|WIRTE|Windshift|Wizard Spider|admin@338|menuPass
+T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD
+T1565.003,Runtime Data Manipulation,Impact,APT38
+T1565.002,Transmitted Data Manipulation,Impact,APT38
+T1565.001,Stored Data Manipulation,Impact,APT38
+T1565,Data Manipulation,Impact,FIN13
+T1564.001,Hidden Files and Directories,Defense Evasion,APT28|APT32|FIN13|HAFNIUM|Lazarus Group|LuminousMoth|Mustang Panda|Rocke|Transparent Tribe|Tropic Trooper
+T1564,Hide Artifacts,Defense Evasion,no
+T1563.002,RDP Hijacking,Lateral Movement,Axiom
+T1563.001,SSH Hijacking,Lateral Movement,no
+T1563,Remote Service Session Hijacking,Lateral Movement,no
+T1518.001,Security Software Discovery,Discovery,APT38|Aquatic Panda|Cobalt Group|Darkhotel|FIN8|Kimsuky|Malteiro|MuddyWater|Naikon|Patchwork|Rocke|SideCopy|Sidewinder|TA2541|TeamTNT|The White Company|ToddyCat|Tropic Trooper|Turla|Windshift|Wizard Spider
+T1069.003,Cloud Groups,Discovery,no
+T1069.002,Domain Groups,Discovery,Dragonfly|FIN7|Inception|Ke3chang|LAPSUS$|OilRig|ToddyCat|Turla|Volt Typhoon
+T1087.004,Cloud Account,Discovery,APT29
+T1087.003,Email Account,Discovery,Magic Hound|Sandworm Team|TA505
+T1087.002,Domain Account,Discovery,APT41|BRONZE BUTLER|Chimera|Dragonfly|FIN13|FIN6|Fox Kitten|Ke3chang|LAPSUS$|MuddyWater|OilRig|Poseidon Group|Sandworm Team|Scattered Spider|ToddyCat|Turla|Volt Typhoon|Wizard Spider|menuPass
+T1087.001,Local Account,Discovery,APT1|APT3|APT32|APT41|Chimera|Fox Kitten|Ke3chang|Moses Staff|OilRig|Poseidon Group|Threat Group-3390|Turla|admin@338
+T1553.004,Install Root Certificate,Defense Evasion,no
+T1562.004,Disable or Modify System Firewall,Defense Evasion,APT38|Carbanak|Dragonfly|Kimsuky|Lazarus Group|Magic Hound|Moses Staff|Rocke|TeamTNT|ToddyCat
+T1562.003,Impair Command History Logging,Defense Evasion,APT38
+T1562.002,Disable Windows Event Logging,Defense Evasion,Magic Hound|Threat Group-3390
+T1562.001,Disable or Modify Tools,Defense Evasion,Aquatic Panda|BRONZE BUTLER|Ember Bear|FIN6|Gamaredon Group|Gorgon Group|Indrik Spider|Kimsuky|Lazarus Group|Magic Hound|MuddyWater|Putter Panda|Rocke|TA2541|TA505|TeamTNT|Turla|Wizard Spider
+T1562,Impair Defenses,Defense Evasion,Magic Hound
+T1003.004,LSA Secrets,Credential Access,APT29|APT33|Dragonfly|Ke3chang|Leafminer|MuddyWater|OilRig|Threat Group-3390|menuPass
+T1003.005,Cached Domain Credentials,Credential Access,APT33|Leafminer|MuddyWater|OilRig
+T1561.002,Disk Structure Wipe,Impact,APT37|APT38|Lazarus Group|Sandworm Team
+T1561.001,Disk Content Wipe,Impact,Lazarus Group
+T1561,Disk Wipe,Impact,no
+T1560.003,Archive via Custom Method,Collection,CopyKittens|FIN6|Kimsuky|Lazarus Group|Mustang Panda
+T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
+T1560.001,Archive via Utility,Collection,APT1|APT28|APT3|APT33|APT39|APT41|APT5|Akira|Aquatic Panda|BRONZE BUTLER|Chimera|CopyKittens|Earth Lusca|FIN13|FIN8|Fox Kitten|GALLIUM|Gallmaker|HAFNIUM|Ke3chang|Kimsuky|Magic Hound|MuddyWater|Mustang Panda|Sowbug|ToddyCat|Turla|Volt Typhoon|Wizard Spider|menuPass
+T1560,Archive Collected Data,Collection,APT28|APT32|Axiom|Dragonfly|FIN6|Ke3chang|Lazarus Group|Leviathan|LuminousMoth|Patchwork|menuPass
+T1499.004,Application or System Exploitation,Impact,no
+T1499.003,Application Exhaustion Flood,Impact,no
+T1499.002,Service Exhaustion Flood,Impact,no
+T1499.001,OS Exhaustion Flood,Impact,no
+T1491.002,External Defacement,Impact,Sandworm Team
+T1491.001,Internal Defacement,Impact,Gamaredon Group|Lazarus Group
+T1114.003,Email Forwarding Rule,Collection,Kimsuky|LAPSUS$|Silent Librarian
+T1114.002,Remote Email Collection,Collection,APT1|APT28|APT29|Chimera|Dragonfly|FIN4|HAFNIUM|Ke3chang|Kimsuky|Leafminer|Magic Hound
+T1114.001,Local Email Collection,Collection,APT1|Chimera|Magic Hound
+T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
+T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
+T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,FIN13
+T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Lazarus Group|Turla
+T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28|FIN8
+T1213.002,Sharepoint,Collection,APT28|Akira|Chimera|Ke3chang|LAPSUS$
+T1213.001,Confluence,Collection,LAPSUS$
+T1555.003,Credentials from Web Browsers,Credential Access,APT3|APT33|APT37|APT41|Ajax Security Team|FIN6|HEXANE|Inception|Kimsuky|LAPSUS$|Leafminer|Malteiro|Molerats|MuddyWater|OilRig|Patchwork|Sandworm Team|Stealth Falcon|TA505|ZIRCONIUM
+T1555.002,Securityd Memory,Credential Access,no
+T1555.001,Keychain,Credential Access,no
+T1559.002,Dynamic Data Exchange,Execution,APT28|APT37|BITTER|Cobalt Group|FIN7|Gallmaker|Leviathan|MuddyWater|Patchwork|Sidewinder|TA505
+T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
+T1559,Inter-Process Communication,Execution,no
+T1558.002,Silver Ticket,Credential Access,no
+T1558.001,Golden Ticket,Credential Access,Ke3chang
+T1558,Steal or Forge Kerberos Tickets,Credential Access,no
+T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Collection|Credential Access,Lazarus Group|Wizard Spider
+T1557,Adversary-in-the-Middle,Collection|Credential Access,Kimsuky
+T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider
+T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera
+T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,FIN13
+T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
+T1056.003,Web Portal Capture,Collection|Credential Access,no
+T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
+T1056.001,Keylogging,Collection|Credential Access,APT28|APT3|APT32|APT38|APT39|APT41|APT5|Ajax Security Team|Darkhotel|FIN13|FIN4|Group5|HEXANE|Ke3chang|Kimsuky|Lazarus Group|Magic Hound|OilRig|PLATINUM|Sandworm Team|Sowbug|Threat Group-3390|Tonto Team|menuPass
+T1555,Credentials from Password Stores,Credential Access,APT33|APT39|Evilnum|FIN6|HEXANE|Leafminer|Malteiro|MuddyWater|OilRig|Stealth Falcon|Volt Typhoon
+T1552.005,Cloud Instance Metadata API,Credential Access,TeamTNT
+T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
+T1003.007,Proc Filesystem,Credential Access,no
+T1003.006,DCSync,Credential Access,Earth Lusca|LAPSUS$
+T1558.003,Kerberoasting,Credential Access,FIN7|Wizard Spider
+T1552.006,Group Policy Preferences,Credential Access,APT33|Wizard Spider
+T1003.003,NTDS,Credential Access,APT28|APT41|Chimera|Dragonfly|FIN13|FIN6|Fox Kitten|HAFNIUM|Ke3chang|LAPSUS$|Mustang Panda|Sandworm Team|Scattered Spider|Volt Typhoon|Wizard Spider|menuPass
+T1003.002,Security Account Manager,Credential Access,APT29|APT41|APT5|Dragonfly|FIN13|GALLIUM|Ke3chang|Threat Group-3390|Wizard Spider|menuPass
+T1003.001,LSASS Memory,Credential Access,APT1|APT28|APT3|APT32|APT33|APT39|APT41|APT5|Aquatic Panda|BRONZE BUTLER|Blue Mockingbird|Cleaver|Earth Lusca|FIN13|FIN6|FIN8|Fox Kitten|GALLIUM|HAFNIUM|Indrik Spider|Ke3chang|Kimsuky|Leafminer|Leviathan|Magic Hound|MuddyWater|OilRig|PLATINUM|Sandworm Team|Silence|Threat Group-3390|Volt Typhoon|Whitefly|Wizard Spider
+T1110.004,Credential Stuffing,Credential Access,Chimera
+T1110.003,Password Spraying,Credential Access,APT28|APT29|APT33|Chimera|HEXANE|Lazarus Group|Leafminer|Silent Librarian
+T1110.002,Password Cracking,Credential Access,APT3|APT41|Dragonfly|FIN6
+T1110.001,Password Guessing,Credential Access,APT28|APT29
+T1021.006,Windows Remote Management,Lateral Movement,Chimera|FIN13|Threat Group-3390|Wizard Spider
+T1021.005,VNC,Lateral Movement,FIN7|Fox Kitten|GCMAN|Gamaredon Group
+T1021.004,SSH,Lateral Movement,APT39|APT5|BlackTech|FIN13|FIN7|Fox Kitten|GCMAN|Lazarus Group|Leviathan|OilRig|Rocke|TeamTNT|menuPass
+T1021.003,Distributed Component Object Model,Lateral Movement,no
+T1021.002,SMB/Windows Admin Shares,Lateral Movement,APT28|APT3|APT32|APT39|APT41|Blue Mockingbird|Chimera|Cinnamon Tempest|Deep Panda|FIN13|FIN8|Fox Kitten|Ke3chang|Lazarus Group|Moses Staff|Orangeworm|Sandworm Team|Threat Group-1314|ToddyCat|Turla|Wizard Spider
+T1021.001,Remote Desktop Protocol,Lateral Movement,APT1|APT3|APT39|APT41|APT5|Axiom|Blue Mockingbird|Chimera|Cobalt Group|Dragonfly|FIN10|FIN13|FIN6|FIN7|FIN8|Fox Kitten|HEXANE|Kimsuky|Lazarus Group|Leviathan|Magic Hound|OilRig|Patchwork|Silence|Wizard Spider|menuPass
+T1554,Compromise Host Software Binary,Persistence,APT5
+T1036.006,Space after Filename,Defense Evasion,no
+T1036.005,Match Legitimate Name or Location,Defense Evasion,APT1|APT28|APT29|APT32|APT39|APT41|APT5|Aoqin Dragon|BRONZE BUTLER|BackdoorDiplomacy|Blue Mockingbird|Carbanak|Chimera|Darkhotel|Earth Lusca|FIN13|FIN7|Ferocious Kitten|Fox Kitten|Gamaredon Group|Indrik Spider|Ke3chang|Kimsuky|Lazarus Group|LuminousMoth|Machete|Magic Hound|MuddyWater|Mustang Panda|Mustard Tempest|Naikon|PROMETHIUM|Patchwork|Poseidon Group|Rocke|Sandworm Team|SideCopy|Sidewinder|Silence|Sowbug|TA2541|TeamTNT|ToddyCat|Transparent Tribe|Tropic Trooper|Volt Typhoon|WIRTE|Whitefly|admin@338|menuPass
+T1036.004,Masquerade Task or Service,Defense Evasion,APT-C-36|APT32|APT41|BITTER|BackdoorDiplomacy|Carbanak|FIN13|FIN6|FIN7|Fox Kitten|Higaisa|Kimsuky|Lazarus Group|Magic Hound|Naikon|PROMETHIUM|Wizard Spider|ZIRCONIUM
+T1036.003,Rename System Utilities,Defense Evasion,APT32|GALLIUM|Lazarus Group|menuPass
+T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ferocious Kitten|Ke3chang|Scarlet Mimic
+T1036.001,Invalid Code Signature,Defense Evasion,APT37|Windshift
+T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
+T1553.002,Code Signing,Defense Evasion,APT41|CopyKittens|Darkhotel|Ember Bear|FIN6|FIN7|GALLIUM|Kimsuky|Lazarus Group|Leviathan|LuminousMoth|Molerats|Moses Staff|PROMETHIUM|Patchwork|Scattered Spider|Silence|Suckfly|TA505|Winnti Group|Wizard Spider|menuPass
+T1553.001,Gatekeeper Bypass,Defense Evasion,no
+T1553,Subvert Trust Controls,Defense Evasion,Axiom
+T1027.003,Steganography,Defense Evasion,APT37|Andariel|BRONZE BUTLER|Earth Lusca|Leviathan|MuddyWater|TA551|Tropic Trooper
+T1027.002,Software Packing,Defense Evasion,APT29|APT3|APT38|APT39|APT41|Aoqin Dragon|Dark Caracal|Elderwood|Ember Bear|GALLIUM|Kimsuky|MoustachedBouncer|Patchwork|Rocke|TA2541|TA505|TeamTNT|The White Company|Threat Group-3390|ZIRCONIUM
+T1027.001,Binary Padding,Defense Evasion,APT29|APT32|BRONZE BUTLER|Ember Bear|FIN7|Gamaredon Group|Higaisa|Leviathan|Moafee|Mustang Panda|Patchwork
+T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,APT32|Rocke|TeamTNT
+T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider
+T1552.004,Private Keys,Credential Access,Rocke|Scattered Spider|TeamTNT
+T1552.003,Bash History,Credential Access,no
+T1552.002,Credentials in Registry,Credential Access,APT32
+T1552.001,Credentials In Files,Credential Access,APT3|APT33|FIN13|Fox Kitten|Kimsuky|Leafminer|MuddyWater|OilRig|Scattered Spider|TA505|TeamTNT
+T1552,Unsecured Credentials,Credential Access,no
+T1216.001,PubPrn,Defense Evasion,APT32
+T1070.006,Timestomp,Defense Evasion,APT28|APT29|APT32|APT38|APT5|Chimera|Kimsuky|Lazarus Group|Rocke
+T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
+T1070.004,File Deletion,Defense Evasion,APT18|APT28|APT29|APT3|APT32|APT38|APT39|APT41|APT5|Aquatic Panda|BRONZE BUTLER|Chimera|Cobalt Group|Dragonfly|Evilnum|FIN10|FIN5|FIN6|FIN8|Gamaredon Group|Group5|Kimsuky|Lazarus Group|Magic Hound|Metador|Mustang Panda|OilRig|Patchwork|Rocke|Sandworm Team|Silence|TeamTNT|The White Company|Threat Group-3390|Tropic Trooper|Volt Typhoon|Wizard Spider|menuPass
+T1070.003,Clear Command History,Defense Evasion,APT41|APT5|Lazarus Group|Magic Hound|TeamTNT|menuPass
+T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
+T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
+T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT29|APT32|BRONZE BUTLER
+T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,APT1|APT28|APT32|APT41|Chimera|FIN13|GALLIUM|Kimsuky|Wizard Spider
+T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
+T1548.004,Elevated Execution with Prompt,Defense Evasion|Privilege Escalation,no
+T1548.003,Sudo and Sudo Caching,Defense Evasion|Privilege Escalation,no
+T1548.002,Bypass User Account Control,Defense Evasion|Privilege Escalation,APT29|APT37|BRONZE BUTLER|Cobalt Group|Earth Lusca|Evilnum|MuddyWater|Patchwork|Threat Group-3390
+T1548.001,Setuid and Setgid,Defense Evasion|Privilege Escalation,no
+T1548,Abuse Elevation Control Mechanism,Defense Evasion|Privilege Escalation,no
+T1136.003,Cloud Account,Persistence,APT29|LAPSUS$
+T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke|TeamTNT
+T1070.001,Clear Windows Event Logs,Defense Evasion,APT28|APT32|APT38|APT41|Chimera|Dragonfly|FIN5|FIN8|Indrik Spider
+T1136.002,Domain Account,Persistence,GALLIUM|HAFNIUM|Wizard Spider
+T1136.001,Local Account,Persistence,APT3|APT39|APT41|APT5|Dragonfly|FIN13|Fox Kitten|Kimsuky|Leafminer|Magic Hound|TeamTNT|Wizard Spider
+T1547.010,Port Monitors,Persistence|Privilege Escalation,no
+T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Gorgon Group|Lazarus Group|Leviathan
+T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
+T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
+T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
+T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
+T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla|Wizard Spider
+T1547.003,Time Providers,Persistence|Privilege Escalation,no
+T1546.014,Emond,Persistence|Privilege Escalation,no
+T1546.013,PowerShell Profile,Persistence|Privilege Escalation,Turla
+T1546.012,Image File Execution Options Injection,Persistence|Privilege Escalation,no
+T1218.008,Odbcconf,Defense Evasion,Cobalt Group
+T1546.011,Application Shimming,Persistence|Privilege Escalation,FIN7
+T1547.002,Authentication Package,Persistence|Privilege Escalation,no
+T1546.010,AppInit DLLs,Persistence|Privilege Escalation,APT39
+T1546.009,AppCert DLLs,Persistence|Privilege Escalation,no
+T1218.007,Msiexec,Defense Evasion,Machete|Molerats|Rancor|TA505|ZIRCONIUM
+T1546.008,Accessibility Features,Persistence|Privilege Escalation,APT29|APT3|APT41|Axiom|Deep Panda|Fox Kitten
+T1546.007,Netsh Helper DLL,Persistence|Privilege Escalation,no
+T1546.006,LC_LOAD_DYLIB Addition,Persistence|Privilege Escalation,no
+T1546.005,Trap,Persistence|Privilege Escalation,no
+T1546.004,Unix Shell Configuration Modification,Persistence|Privilege Escalation,no
+T1546.003,Windows Management Instrumentation Event Subscription,Persistence|Privilege Escalation,APT29|APT33|Blue Mockingbird|FIN8|HEXANE|Leviathan|Metador|Mustang Panda|Rancor|Turla
+T1546.002,Screensaver,Persistence|Privilege Escalation,no
+T1546.001,Change Default File Association,Persistence|Privilege Escalation,Kimsuky
+T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,APT18|APT19|APT28|APT29|APT3|APT32|APT33|APT37|APT39|APT41|BRONZE BUTLER|Cobalt Group|Confucius|Dark Caracal|Darkhotel|Dragonfly|FIN10|FIN13|FIN6|FIN7|Gamaredon Group|Gorgon Group|Higaisa|Inception|Ke3chang|Kimsuky|Lazarus Group|LazyScripter|Leviathan|LuminousMoth|Magic Hound|Molerats|MuddyWater|Mustang Panda|Naikon|PROMETHIUM|Patchwork|Putter Panda|RTM|Rocke|Sidewinder|Silence|TA2541|TeamTNT|Threat Group-3390|Tropic Trooper|Turla|Windshift|Wizard Spider|ZIRCONIUM
+T1218.002,Control Panel,Defense Evasion,Ember Bear
+T1218.010,Regsvr32,Defense Evasion,APT19|APT32|Blue Mockingbird|Cobalt Group|Deep Panda|Inception|Kimsuky|Leviathan|TA551|WIRTE
+T1218.009,Regsvcs/Regasm,Defense Evasion,no
+T1218.005,Mshta,Defense Evasion,APT29|APT32|Confucius|Earth Lusca|FIN7|Gamaredon Group|Inception|Kimsuky|Lazarus Group|LazyScripter|MuddyWater|Mustang Panda|SideCopy|Sidewinder|TA2541|TA551
+T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass
+T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Dark Caracal|OilRig|Silence
+T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
+T1218.011,Rundll32,Defense Evasion,APT19|APT28|APT3|APT32|APT38|APT41|Blue Mockingbird|Carbanak|CopyKittens|FIN7|Gamaredon Group|HAFNIUM|Kimsuky|Lazarus Group|LazyScripter|Magic Hound|MuddyWater|Sandworm Team|TA505|TA551|Wizard Spider
+T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
+T1546,Event Triggered Execution,Persistence|Privilege Escalation,no
+T1098.003,Additional Cloud Roles,Persistence|Privilege Escalation,LAPSUS$|Scattered Spider
+T1098.002,Additional Email Delegate Permissions,Persistence|Privilege Escalation,APT28|APT29|Magic Hound
+T1098.001,Additional Cloud Credentials,Persistence|Privilege Escalation,no
+T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
+T1543.003,Windows Service,Persistence|Privilege Escalation,APT19|APT3|APT32|APT38|APT41|Blue Mockingbird|Carbanak|Cinnamon Tempest|Cobalt Group|DarkVishnya|Earth Lusca|FIN7|Ke3chang|Kimsuky|Lazarus Group|PROMETHIUM|TeamTNT|Threat Group-3390|Tropic Trooper|Wizard Spider
+T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke|TeamTNT
+T1543.001,Launch Agent,Persistence|Privilege Escalation,no
+T1037.005,Startup Items,Persistence|Privilege Escalation,no
+T1037.004,RC Scripts,Persistence|Privilege Escalation,APT29
+T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Gorgon Group|Kimsuky|Patchwork|TA2541|Threat Group-3390|menuPass
+T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
+T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
+T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
+T1055.009,Proc Memory,Defense Evasion|Privilege Escalation,no
+T1055.008,Ptrace System Calls,Defense Evasion|Privilege Escalation,no
+T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
+T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,FIN8
+T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
+T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Gorgon Group|Rocke
+T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,BackdoorDiplomacy|Lazarus Group|Leviathan|Malteiro|Putter Panda|TA505|Tropic Trooper|Turla|Wizard Spider
+T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
+T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
+T1037.002,Login Hook,Persistence|Privilege Escalation,no
+T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,APT28|Cobalt Group
+T1542.003,Bootkit,Defense Evasion|Persistence,APT28|APT41|Lazarus Group
+T1542.002,Component Firmware,Defense Evasion|Persistence,Equation
+T1542.001,System Firmware,Defense Evasion|Persistence,no
+T1505.003,Web Shell,Persistence,APT28|APT29|APT32|APT38|APT39|APT5|BackdoorDiplomacy|Deep Panda|Dragonfly|FIN13|Fox Kitten|GALLIUM|HAFNIUM|Kimsuky|Leviathan|Magic Hound|Moses Staff|OilRig|Sandworm Team|Threat Group-3390|Tonto Team|Tropic Trooper|Volatile Cedar|Volt Typhoon
+T1505.002,Transport Agent,Persistence,no
+T1505.001,SQL Stored Procedures,Persistence,no
+T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|APT5|Rocke
+T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT-C-36|APT29|APT3|APT32|APT33|APT37|APT38|APT39|APT41|BITTER|BRONZE BUTLER|Blue Mockingbird|Chimera|Cobalt Group|Confucius|Dragonfly|FIN10|FIN13|FIN6|FIN7|FIN8|Fox Kitten|GALLIUM|Gamaredon Group|HEXANE|Higaisa|Kimsuky|Lazarus Group|LuminousMoth|Machete|Magic Hound|Molerats|MuddyWater|Mustang Panda|Naikon|OilRig|Patchwork|Rancor|Silence|Stealth Falcon|TA2541|ToddyCat|Wizard Spider|menuPass
+T1053.002,At,Execution|Persistence|Privilege Escalation,APT18|BRONZE BUTLER|Threat Group-3390
+T1542,Pre-OS Boot,Defense Evasion|Persistence,no
+T1137.001,Office Template Macros,Persistence,MuddyWater
+T1137.004,Outlook Home Page,Persistence,OilRig
+T1137.003,Outlook Forms,Persistence,no
+T1137.005,Outlook Rules,Persistence,no
+T1137.006,Add-ins,Persistence,Naikon
+T1137.002,Office Test,Persistence,APT28
+T1531,Account Access Removal,Impact,Akira|LAPSUS$
+T1539,Steal Web Session Cookie,Credential Access,Evilnum|LuminousMoth|Sandworm Team|Scattered Spider
+T1529,System Shutdown/Reboot,Impact,APT37|APT38|Lazarus Group
+T1518,Software Discovery,Discovery,BRONZE BUTLER|HEXANE|Inception|MuddyWater|Mustang Panda|SideCopy|Sidewinder|Tropic Trooper|Volt Typhoon|Windigo|Windshift|Wizard Spider
+T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no
+T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group|HEXANE|Kimsuky|Leviathan
+T1528,Steal Application Access Token,Credential Access,APT28|APT29
+T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
+T1525,Implant Internal Image,Persistence,no
+T1538,Cloud Service Dashboard,Discovery,Scattered Spider
+T1530,Data from Cloud Storage,Collection,Fox Kitten|Scattered Spider
+T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
+T1537,Transfer Data to Cloud Account,Exfiltration,no
+T1526,Cloud Service Discovery,Discovery,no
+T1505,Server Software Component,Persistence,no
+T1499,Endpoint Denial of Service,Impact,Sandworm Team
+T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel
+T1498,Network Denial of Service,Impact,APT28
+T1496,Resource Hijacking,Impact,APT41|Blue Mockingbird|Rocke|TeamTNT
+T1495,Firmware Corruption,Impact,no
+T1491,Defacement,Impact,no
+T1490,Inhibit System Recovery,Impact,Wizard Spider
+T1489,Service Stop,Impact,Indrik Spider|LAPSUS$|Lazarus Group|Wizard Spider
+T1486,Data Encrypted for Impact,Impact,APT38|APT41|Akira|FIN7|FIN8|Indrik Spider|Magic Hound|Sandworm Team|Scattered Spider|TA505
+T1485,Data Destruction,Impact,APT38|Gamaredon Group|LAPSUS$|Lazarus Group|Sandworm Team
+T1484,Domain or Tenant Policy Modification,Defense Evasion|Privilege Escalation,no
+T1482,Domain Trust Discovery,Discovery,Akira|Chimera|Earth Lusca|FIN8|Magic Hound
+T1480,Execution Guardrails,Defense Evasion,no
+T1222,File and Directory Permissions Modification,Defense Evasion,no
+T1220,XSL Script Processing,Defense Evasion,Cobalt Group|Higaisa
+T1221,Template Injection,Defense Evasion,APT28|Confucius|DarkHydrus|Dragonfly|Gamaredon Group|Inception|Tropic Trooper
+T1190,Exploit Public-Facing Application,Initial Access,APT28|APT29|APT39|APT41|APT5|Axiom|BackdoorDiplomacy|BlackTech|Blue Mockingbird|Cinnamon Tempest|Dragonfly|Earth Lusca|FIN13|FIN7|Fox Kitten|GALLIUM|GOLD SOUTHFIELD|HAFNIUM|Ke3chang|Kimsuky|Magic Hound|Moses Staff|MuddyWater|Rocke|Sandworm Team|Threat Group-3390|ToddyCat|Volatile Cedar|Volt Typhoon|menuPass
+T1213,Data from Information Repositories,Collection,APT28|FIN6|Fox Kitten|LAPSUS$|Sandworm Team|Turla
+T1202,Indirect Command Execution,Defense Evasion,Lazarus Group
+T1207,Rogue Domain Controller,Defense Evasion,no
+T1212,Exploitation for Credential Access,Credential Access,no
+T1201,Password Policy Discovery,Discovery,Chimera|OilRig|Turla
+T1197,BITS Jobs,Defense Evasion|Persistence,APT39|APT41|Leviathan|Patchwork|Wizard Spider
+T1189,Drive-by Compromise,Initial Access,APT19|APT28|APT32|APT37|APT38|Andariel|Axiom|BRONZE BUTLER|Dark Caracal|Darkhotel|Dragonfly|Earth Lusca|Elderwood|Lazarus Group|Leafminer|Leviathan|Machete|Magic Hound|Mustard Tempest|PLATINUM|PROMETHIUM|Patchwork|RTM|Threat Group-3390|Transparent Tribe|Turla|Windigo|Windshift
+T1218,System Binary Proxy Execution,Defense Evasion,Lazarus Group
+T1210,Exploitation of Remote Services,Lateral Movement,APT28|Dragonfly|Earth Lusca|FIN7|Fox Kitten|MuddyWater|Threat Group-3390|Tonto Team|Wizard Spider|menuPass
+T1203,Exploitation for Client Execution,Execution,APT12|APT28|APT29|APT3|APT32|APT33|APT37|APT41|Andariel|Aoqin Dragon|Axiom|BITTER|BRONZE BUTLER|BlackTech|Cobalt Group|Confucius|Darkhotel|Dragonfly|EXOTIC LILY|Elderwood|Ember Bear|Higaisa|Inception|Lazarus Group|Leviathan|MuddyWater|Mustang Panda|Patchwork|Sandworm Team|Sidewinder|TA459|The White Company|Threat Group-3390|Tonto Team|Transparent Tribe|Tropic Trooper|admin@338
+T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
+T1216,System Script Proxy Execution,Defense Evasion,no
+T1195,Supply Chain Compromise,Initial Access,no
+T1219,Remote Access Software,Command And Control,Akira|Carbanak|Cobalt Group|DarkVishnya|Evilnum|FIN7|GOLD SOUTHFIELD|Kimsuky|MuddyWater|Mustang Panda|RTM|Sandworm Team|Scattered Spider|TeamTNT|Thrip
+T1205,Traffic Signaling,Command And Control|Defense Evasion|Persistence,no
+T1204,User Execution,Execution,LAPSUS$|Scattered Spider
+T1199,Trusted Relationship,Initial Access,APT28|APT29|GOLD SOUTHFIELD|LAPSUS$|POLONIUM|Sandworm Team|Threat Group-3390|menuPass
+T1217,Browser Information Discovery,Discovery,APT38|Chimera|Fox Kitten|Scattered Spider
+T1200,Hardware Additions,Initial Access,DarkVishnya
+T1176,Browser Extensions,Persistence,Kimsuky
+T1185,Browser Session Hijacking,Collection,no
+T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly
+T1137,Office Application Startup,Persistence,APT32|Gamaredon Group
+T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT19|APT28|APT39|BRONZE BUTLER|Cinnamon Tempest|Darkhotel|Earth Lusca|FIN13|Gamaredon Group|Gorgon Group|Higaisa|Ke3chang|Kimsuky|Lazarus Group|Leviathan|Malteiro|Molerats|MuddyWater|OilRig|Rocke|Sandworm Team|TA505|TeamTNT|Threat Group-3390|Tropic Trooper|Turla|WIRTE|ZIRCONIUM|menuPass
+T1136,Create Account,Persistence,Indrik Spider|Scattered Spider
+T1135,Network Share Discovery,Discovery,APT1|APT32|APT38|APT39|APT41|Chimera|DarkVishnya|Dragonfly|FIN13|Sowbug|Tonto Team|Tropic Trooper|Wizard Spider
+T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird|FIN6
+T1133,External Remote Services,Initial Access|Persistence,APT18|APT28|APT29|APT41|Akira|Chimera|Dragonfly|FIN13|FIN5|GALLIUM|GOLD SOUTHFIELD|Ke3chang|Kimsuky|LAPSUS$|Leviathan|OilRig|Sandworm Team|Scattered Spider|TeamTNT|Threat Group-3390|Wizard Spider
+T1132,Data Encoding,Command And Control,no
+T1129,Shared Modules,Execution,no
+T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
+T1125,Video Capture,Collection,FIN7|Silence
+T1124,System Time Discovery,Discovery,BRONZE BUTLER|Chimera|Darkhotel|Higaisa|Lazarus Group|Sidewinder|The White Company|Turla|ZIRCONIUM
+T1123,Audio Capture,Collection,APT37
+T1120,Peripheral Device Discovery,Discovery,APT28|APT37|BackdoorDiplomacy|Equation|Gamaredon Group|OilRig|TeamTNT|Turla
+T1119,Automated Collection,Collection,APT1|APT28|Chimera|Confucius|FIN5|FIN6|Gamaredon Group|Ke3chang|Mustang Panda|OilRig|Patchwork|Sidewinder|Threat Group-3390|Tropic Trooper|menuPass
+T1115,Clipboard Data,Collection,APT38|APT39
+T1114,Email Collection,Collection,Magic Hound|Silent Librarian
+T1113,Screen Capture,Collection,APT28|APT39|BRONZE BUTLER|Dark Caracal|Dragonfly|FIN7|GOLD SOUTHFIELD|Gamaredon Group|Group5|Magic Hound|MoustachedBouncer|MuddyWater|OilRig|Silence
+T1112,Modify Registry,Defense Evasion,APT19|APT32|APT38|APT41|Blue Mockingbird|Dragonfly|Earth Lusca|Ember Bear|FIN8|Gamaredon Group|Gorgon Group|Kimsuky|LuminousMoth|Magic Hound|Patchwork|Silence|TA505|Threat Group-3390|Turla|Wizard Spider
+T1111,Multi-Factor Authentication Interception,Credential Access,Chimera|Kimsuky|LAPSUS$
+T1110,Brute Force,Credential Access,APT28|APT38|APT39|DarkVishnya|Dragonfly|FIN5|Fox Kitten|HEXANE|OilRig|Turla
+T1106,Native API,Execution,APT37|APT38|BlackTech|Chimera|Gamaredon Group|Gorgon Group|Higaisa|Lazarus Group|SideCopy|Silence|TA505|ToddyCat|Tropic Trooper|Turla|menuPass
+T1105,Ingress Tool Transfer,Command And Control,APT-C-36|APT18|APT28|APT29|APT3|APT32|APT33|APT37|APT38|APT39|APT41|Ajax Security Team|Andariel|Aquatic Panda|BITTER|BRONZE BUTLER|BackdoorDiplomacy|Chimera|Cinnamon Tempest|Cobalt Group|Confucius|Darkhotel|Dragonfly|Elderwood|Ember Bear|Evilnum|FIN13|FIN7|FIN8|Fox Kitten|GALLIUM|Gamaredon Group|Gorgon Group|HAFNIUM|HEXANE|IndigoZebra|Indrik Spider|Ke3chang|Kimsuky|Lazarus Group|LazyScripter|Leviathan|LuminousMoth|Magic Hound|Metador|Molerats|Moses Staff|MuddyWater|Mustang Panda|Mustard Tempest|Nomadic Octopus|OilRig|PLATINUM|Patchwork|Rancor|Rocke|Sandworm Team|SideCopy|Sidewinder|Silence|TA2541|TA505|TA551|TeamTNT|Threat Group-3390|Tonto Team|Tropic Trooper|Turla|Volatile Cedar|WIRTE|Whitefly|Windshift|Winnti Group|Wizard Spider|ZIRCONIUM|menuPass
+T1104,Multi-Stage Channels,Command And Control,APT3|APT41|Lazarus Group|MuddyWater
+T1102,Web Service,Command And Control,APT32|EXOTIC LILY|Ember Bear|FIN6|FIN8|Fox Kitten|Gamaredon Group|Inception|LazyScripter|Mustang Panda|Rocke|TeamTNT|Turla
+T1098,Account Manipulation,Persistence|Privilege Escalation,APT3|APT41|APT5|Dragonfly|FIN13|HAFNIUM|Kimsuky|Lazarus Group|Magic Hound
+T1095,Non-Application Layer Protocol,Command And Control,APT3|BITTER|BackdoorDiplomacy|FIN6|HAFNIUM|Metador|PLATINUM|ToddyCat
+T1092,Communication Through Removable Media,Command And Control,APT28
+T1091,Replication Through Removable Media,Initial Access|Lateral Movement,APT28|Aoqin Dragon|Darkhotel|FIN7|LuminousMoth|Mustang Panda|Tropic Trooper
+T1090,Proxy,Command And Control,APT41|Blue Mockingbird|Cinnamon Tempest|CopyKittens|Earth Lusca|Fox Kitten|LAPSUS$|Magic Hound|MoustachedBouncer|POLONIUM|Sandworm Team|Turla|Volt Typhoon|Windigo
+T1087,Account Discovery,Discovery,FIN13
+T1083,File and Directory Discovery,Discovery,APT18|APT28|APT3|APT32|APT38|APT39|APT41|APT5|Aoqin Dragon|BRONZE BUTLER|Chimera|Confucius|Dark Caracal|Darkhotel|Dragonfly|FIN13|Fox Kitten|Gamaredon Group|HAFNIUM|Inception|Ke3chang|Kimsuky|Lazarus Group|Leafminer|LuminousMoth|Magic Hound|MuddyWater|Mustang Panda|Patchwork|Sandworm Team|Scattered Spider|Sidewinder|Sowbug|TeamTNT|ToddyCat|Tropic Trooper|Turla|Windigo|Winnti Group|admin@338|menuPass
+T1082,System Information Discovery,Discovery,APT18|APT19|APT3|APT32|APT37|APT38|APT41|Aquatic Panda|Blue Mockingbird|Chimera|Confucius|Darkhotel|FIN13|FIN8|Gamaredon Group|HEXANE|Higaisa|Inception|Ke3chang|Kimsuky|Lazarus Group|Magic Hound|Malteiro|Moses Staff|MuddyWater|Mustang Panda|Mustard Tempest|OilRig|Patchwork|Rocke|Sandworm Team|SideCopy|Sidewinder|Sowbug|Stealth Falcon|TA2541|TeamTNT|ToddyCat|Tropic Trooper|Turla|Volt Typhoon|Windigo|Windshift|Wizard Spider|ZIRCONIUM|admin@338
+T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Cinnamon Tempest|Darkhotel|Gamaredon Group
+T1078,Valid Accounts,Defense Evasion|Initial Access|Persistence|Privilege Escalation,APT18|APT28|APT29|APT33|APT39|APT41|Akira|Axiom|Carbanak|Chimera|Cinnamon Tempest|Dragonfly|FIN10|FIN4|FIN5|FIN6|FIN7|FIN8|Fox Kitten|GALLIUM|Ke3chang|LAPSUS$|Lazarus Group|Leviathan|OilRig|POLONIUM|PittyTiger|Sandworm Team|Silence|Silent Librarian|Suckfly|Threat Group-3390|Wizard Spider|menuPass
+T1074,Data Staged,Collection,Scattered Spider|Volt Typhoon|Wizard Spider
+T1072,Software Deployment Tools,Execution|Lateral Movement,APT32|Sandworm Team|Silence|Threat Group-1314
+T1071,Application Layer Protocol,Command And Control,Magic Hound|Rocke|TeamTNT
+T1070,Indicator Removal,Defense Evasion,APT5|Lazarus Group
+T1069,Permission Groups Discovery,Discovery,APT3|APT41|FIN13|TA505
+T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT28|APT29|APT32|APT33|BITTER|Cobalt Group|FIN6|FIN8|LAPSUS$|MoustachedBouncer|PLATINUM|Scattered Spider|Threat Group-3390|Tonto Team|Turla|Whitefly|ZIRCONIUM
+T1059,Command and Scripting Interpreter,Execution,APT19|APT32|APT37|APT39|Dragonfly|FIN5|FIN6|FIN7|Fox Kitten|Ke3chang|OilRig|Stealth Falcon|Whitefly|Windigo
+T1057,Process Discovery,Discovery,APT1|APT28|APT3|APT37|APT38|APT5|Andariel|Chimera|Darkhotel|Deep Panda|Earth Lusca|Gamaredon Group|HAFNIUM|HEXANE|Higaisa|Inception|Ke3chang|Kimsuky|Lazarus Group|Magic Hound|Molerats|MuddyWater|Mustang Panda|OilRig|Poseidon Group|Rocke|Sidewinder|Stealth Falcon|TeamTNT|ToddyCat|Tropic Trooper|Turla|Volt Typhoon|Windshift|Winnti Group
+T1056,Input Capture,Collection|Credential Access,APT39
+T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|APT37|APT41|APT5|Cobalt Group|Kimsuky|PLATINUM|Silence|TA2541|Turla|Wizard Spider
+T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,Earth Lusca
+T1052,Exfiltration Over Physical Medium,Exfiltration,no
+T1049,System Network Connections Discovery,Discovery,APT1|APT3|APT32|APT38|APT41|APT5|Andariel|BackdoorDiplomacy|Chimera|Earth Lusca|FIN13|GALLIUM|HEXANE|Ke3chang|Lazarus Group|Magic Hound|MuddyWater|Mustang Panda|OilRig|Poseidon Group|Sandworm Team|TeamTNT|Threat Group-3390|ToddyCat|Tropic Trooper|Turla|Volt Typhoon|admin@338|menuPass
+T1048,Exfiltration Over Alternative Protocol,Exfiltration,TeamTNT
+T1047,Windows Management Instrumentation,Execution,APT29|APT32|APT41|Blue Mockingbird|Chimera|Cinnamon Tempest|Deep Panda|Earth Lusca|FIN13|FIN6|FIN7|FIN8|GALLIUM|Gamaredon Group|Indrik Spider|Lazarus Group|Leviathan|Magic Hound|MuddyWater|Mustang Panda|Naikon|OilRig|Sandworm Team|Stealth Falcon|TA2541|Threat Group-3390|ToddyCat|Volt Typhoon|Windshift|Wizard Spider|menuPass
+T1046,Network Service Discovery,Discovery,APT32|APT39|APT41|BackdoorDiplomacy|BlackTech|Chimera|Cobalt Group|DarkVishnya|FIN13|FIN6|Fox Kitten|Lazarus Group|Leafminer|Magic Hound|Naikon|OilRig|Rocke|Suckfly|TeamTNT|Threat Group-3390|Tropic Trooper|menuPass
+T1041,Exfiltration Over C2 Channel,Exfiltration,APT3|APT32|APT39|Chimera|Confucius|GALLIUM|Gamaredon Group|Higaisa|Ke3chang|Kimsuky|Lazarus Group|Leviathan|LuminousMoth|MuddyWater|Sandworm Team|Stealth Falcon|Wizard Spider|ZIRCONIUM
+T1040,Network Sniffing,Credential Access|Discovery,APT28|APT33|DarkVishnya|Kimsuky|Sandworm Team
+T1039,Data from Network Shared Drive,Collection,APT28|BRONZE BUTLER|Chimera|Fox Kitten|Gamaredon Group|Sowbug|menuPass
+T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,APT29|Rocke
+T1036,Masquerading,Defense Evasion,APT28|APT32|BRONZE BUTLER|Dragonfly|FIN13|LazyScripter|Nomadic Octopus|OilRig|PLATINUM|Sandworm Team|TA551|TeamTNT|Windshift|ZIRCONIUM|menuPass
+T1033,System Owner/User Discovery,Discovery,APT19|APT3|APT32|APT37|APT38|APT39|APT41|Chimera|Dragonfly|Earth Lusca|FIN10|FIN7|FIN8|GALLIUM|Gamaredon Group|HAFNIUM|HEXANE|Ke3chang|Lazarus Group|LuminousMoth|Magic Hound|MuddyWater|OilRig|Patchwork|Sandworm Team|Sidewinder|Stealth Falcon|Threat Group-3390|Tropic Trooper|Volt Typhoon|Windshift|Wizard Spider|ZIRCONIUM
+T1030,Data Transfer Size Limits,Exfiltration,APT28|APT41|LuminousMoth|Threat Group-3390
+T1029,Scheduled Transfer,Exfiltration,Higaisa
+T1027,Obfuscated Files or Information,Defense Evasion,APT-C-36|APT3|APT37|APT41|BackdoorDiplomacy|BlackOasis|Earth Lusca|Ember Bear|GALLIUM|Gallmaker|Gamaredon Group|Ke3chang|Kimsuky|Mustang Panda|Rocke|Sandworm Team|Windshift
+T1025,Data from Removable Media,Collection,APT28|Gamaredon Group|Turla
+T1021,Remote Services,Lateral Movement,Wizard Spider
+T1020,Automated Exfiltration,Exfiltration,Gamaredon Group|Ke3chang|Sidewinder|Tropic Trooper
+T1018,Remote System Discovery,Discovery,APT3|APT32|APT39|Akira|BRONZE BUTLER|Chimera|Deep Panda|Dragonfly|Earth Lusca|FIN5|FIN6|FIN8|Fox Kitten|GALLIUM|HAFNIUM|HEXANE|Indrik Spider|Ke3chang|Leafminer|Magic Hound|Naikon|Rocke|Sandworm Team|Scattered Spider|Silence|Threat Group-3390|ToddyCat|Turla|Volt Typhoon|Wizard Spider|menuPass
+T1016,System Network Configuration Discovery,Discovery,APT1|APT19|APT3|APT32|APT41|Chimera|Darkhotel|Dragonfly|Earth Lusca|FIN13|GALLIUM|HAFNIUM|HEXANE|Higaisa|Ke3chang|Kimsuky|Lazarus Group|Magic Hound|Moses Staff|MuddyWater|Mustang Panda|Naikon|OilRig|SideCopy|Sidewinder|Stealth Falcon|TeamTNT|Threat Group-3390|Tropic Trooper|Turla|Volt Typhoon|Wizard Spider|ZIRCONIUM|admin@338|menuPass
+T1014,Rootkit,Defense Evasion,APT28|APT41|Rocke|TeamTNT|Winnti Group
+T1012,Query Registry,Discovery,APT32|APT39|APT41|Chimera|Dragonfly|Fox Kitten|Kimsuky|Lazarus Group|OilRig|Stealth Falcon|Threat Group-3390|Turla|Volt Typhoon|ZIRCONIUM
+T1011,Exfiltration Over Other Network Medium,Exfiltration,no
+T1010,Application Window Discovery,Discovery,HEXANE|Lazarus Group
+T1008,Fallback Channels,Command And Control,APT41|FIN7|Lazarus Group|OilRig
+T1007,System Service Discovery,Discovery,APT1|Aquatic Panda|BRONZE BUTLER|Chimera|Earth Lusca|Indrik Spider|Ke3chang|Kimsuky|OilRig|Poseidon Group|TeamTNT|Turla|admin@338
+T1006,Direct Volume Access,Defense Evasion,Scattered Spider
+T1005,Data from Local System,Collection,APT1|APT28|APT29|APT3|APT37|APT38|APT39|APT41|Andariel|Axiom|BRONZE BUTLER|CURIUM|Dark Caracal|Dragonfly|FIN13|FIN6|FIN7|Fox Kitten|GALLIUM|Gamaredon Group|HAFNIUM|Inception|Ke3chang|Kimsuky|LAPSUS$|Lazarus Group|LuminousMoth|Magic Hound|Patchwork|Sandworm Team|Stealth Falcon|Threat Group-3390|ToddyCat|Turla|Volt Typhoon|Windigo|Wizard Spider|menuPass
+T1003,OS Credential Dumping,Credential Access,APT28|APT32|APT39|Axiom|Leviathan|Poseidon Group|Sowbug|Suckfly|Tonto Team
+T1001,Data Obfuscation,Command And Control,no
@@ -0,0 +1,23 @@
+## shared Application-level permissions
+[]
+access = read : [ * ], write : [ admin ]
+export = system
+
+[savedsearches]
+owner = admin
+
+## Correlation Searches
+[correlationsearches]
+access = read : [ * ], write : [ * ]
+
+[governance]
+access = read : [ * ], write : [ * ]
+
+## Managed Configurations
+[managed_configurations]
+access = read : [ * ], write : [ * ]
+
+## Postprocess
+[postprocess]
+access = read : [ * ], write : [ * ]
+
@@ -28,7 +28,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
  in a reasonable timeframe. By default, the search builds the model using the past
  30 days of data. You can modify the search window to build the model over a longer
  period of time, which may give you better results. You may also want to periodically
-  re-run this search to rebuild the model with the latest data.\
+  re-run this search to rebuild the model with the latest data.

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
 known_false_positives: none
@@ -28,7 +28,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
  in a reasonable timeframe. By default, the search builds the model using the past
  90 days of data. You can modify the search window to build the model over a longer
  period of time, which may give you better results. You may also want to periodically
-  re-run this search to rebuild the model with the latest data.\
+  re-run this search to rebuild the model with the latest data.

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
 known_false_positives: none
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_ru
  fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.\
+  inputs.

  In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed,
  along with any required dependencies. Depending on the number of users in your environment,
@@ -24,7 +24,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  timeframe. By default, the search builds the model using the past 30 days of data.
  You can modify the search window to build the model over a longer period of time,
  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.\
+  search to rebuild the model with the latest data.

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
 known_false_positives: none
@@ -16,7 +16,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excess
  | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.\
+  inputs.

  In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed,
  along with any required dependencies. Depending on the number of users in your environment,
@@ -25,7 +25,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  timeframe. By default, the search builds the model using the past 30 days of data.
  You can modify the search window to build the model over a longer period of time,
  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.\
+  search to rebuild the model with the latest data.

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
 known_false_positives: none
@@ -1,7 +1,7 @@
 name: Previously Seen Cloud Compute Instance Types - Initial
 id: 3c78025c-1ffe-4976-a640-75ef604842be
 version: 1
-date: 2020-9-03
+date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
 datamodel:
@@ -36,4 +36,4 @@ deployment:
    cron_schedule: 0 2 * * 0
    earliest_time: -90d@d
    latest_time: -1d@d
-    schedule_window: auto
+    schedule_window: auto
@@ -1,7 +1,7 @@
 name: Previously Seen Cloud Compute Instance Types - Update
 id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
 version: 1
-date: 2020-9-03
+date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
 datamodel:
@@ -1,25 +1,188 @@
-build:
-  #Temporary fix to support testing. The following
-  #line will be reverted soon
-  title: DA-ESS-ContentUpdate
-  name: DA-ESS-ContentUpdate
-  path_root: dist
+path: .
+app:
+  uid: 3449
+  title: ES Content Updates
+  appid: DA-ESS-ContentUpdate
+  version: 4.31.0
+  description: Explore the Analytic Stories included with ES Content Updates.
  prefix: ESCU
  build: 004210
-  version: 4.30.0
+  version: 4.31.0
  label: ES Content Updates
  author_name: Splunk Threat Research Team
  author_email: research@splunk.com
  author_company: Splunk
-  description: Explore the Analytic Stories included with ES Content Updates.
-  splunk_app: {}
-  json_objects: null
-  ba_objects: null
-build_ssa:
-  path_root: 'dist/ssa'
-build_api:
-  path_root: 'dist/api'
-enrichments:
-  attack_enrichment: false
-  cve_enrichment: false
-  splunk_app_enrichment: false
+enrichments: false
+build_app: true
+build_api: true
+build_ssa: true
+build_path: dist
+test_instance:
+  splunk_app_username: admin
+  instance_address: localhost
+  hec_port: 8088
+  web_ui_port: 8000
+  api_port: 8089
+  full_image_path: registry.hub.docker.com/splunk/splunk:latest
+container_settings:
+  leave_running: true
+  num_containers: 1
+mode: {}
+splunk_api_username: null
+post_test_behavior: pause_on_failure
+apps:
+# - uid: 263
+#   title: Splunk Enterprise Security
+#   appid: SplunkEnterpriseSecuritySuite
+#   version: 7.3.1
+#   description: description of app
+#   hardcoded_path: ~/Downloads/splunk-enterprise-security_731.spl
+- uid: 1621
+  title: Splunk Common Information Model (CIM)
+  appid: Splunk_SA_CIM
+  version: 5.3.2
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_532.tgz
+- uid: 6553
+  title: Splunk Add-on for Okta Identity Cloud
+  appid: Splunk_TA_okta_identity_cloud
+  version: 2.2.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-okta-identity-cloud_220.tgz
+- uid: 6176
+  title: Add-on for Linux Sysmon
+  appid: Splunk_TA_linux_sysmon
+  version: 1.0.4
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz
+- uid: null
+  title: Splunk Fix XmlWinEventLog HEC Parsing
+  appid: Splunk_FIX_XMLWINEVENTLOG_HEC_PARSING
+  version: '0.1'
+  description: This TA is required for replaying Windows Data into the Test Environment.
+    The Default TA does not include logic for properly splitting multiple log events
+    in a single file.  In production environments, this logic is applied by the Universal
+    Forwarder.
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz
+- uid: 742
+  title: Splunk Add-on for Microsoft Windows
+  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS
+  version: 8.8.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_880.tgz
+- uid: 5709
+  title: Splunk Add-on for Sysmon
+  appid: Splunk_TA_microsoft_sysmon
+  version: 4.0.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_400.tgz
+- uid: 833
+  title: Splunk Add-on for Unix and Linux
+  appid: Splunk_TA_nix
+  version: 9.0.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_900.tgz
+- uid: 5579
+  title: Splunk Add-on for CrowdStrike FDR
+  appid: Splunk_TA_CrowdStrike_FDR
+  version: 1.5.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_150.tgz
+- uid: 3185
+  title: Splunk Add-on for Microsoft IIS
+  appid: SPLUNK_TA_FOR_IIS
+  version: 1.3.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_130.tgz
+- uid: 4242
+  title: TA for Suricata
+  appid: SPLUNK_TA_FOR_SURICATA
+  version: 2.3.4
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz
+- uid: 5466
+  title: TA for Zeek
+  appid: SPLUNK_TA_FOR_ZEEK
+  version: 1.0.8
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_108.tgz
+- uid: 3258
+  title: Splunk Add-on for NGINX
+  appid: SPLUNK_ADD_ON_FOR_NGINX
+  version: 3.2.2
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_322.tgz
+- uid: 5238
+  title: Splunk Add-on for Stream Forwarders
+  appid: SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS
+  version: 8.1.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_811.tgz
+- uid: 5234
+  title: Splunk Add-on for Stream Wire Data
+  appid: SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA
+  version: 8.1.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_811.tgz
+- uid: 2757
+  title: Palo Alto Networks Add-on for Splunk
+  appid: PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK
+  version: 8.1.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_811.tgz
+- uid: 3865
+  title: Zscaler Technical Add-On for Splunk
+  appid: Zscaler_CIM
+  version: 4.0.3
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/zscaler-technical-add-on-for-splunk_403.tgz
+- uid: 3719
+  title: Splunk Add-on for Amazon Kinesis Firehose
+  appid: SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE
+  version: 1.3.2
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
+- uid: 1876
+  title: Splunk Add-on for AWS
+  appid: Splunk_TA_aws
+  version: 7.5.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-web-services-aws_750.tgz
+- uid: 3088
+  title: Splunk Add-on for Google Cloud Platform
+  appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM
+  version: 4.5.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_450.tgz
+- uid: 5556
+  title: Splunk Add-on for Google Workspace
+  appid: SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE
+  version: 2.7.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_270.tgz
+- uid: 3110
+  title: Splunk Add-on for Microsoft Cloud Services
+  appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
+  version: 5.2.2
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_522.tgz
+- uid: 4055
+  title: Splunk Add-on for Microsoft Office 365
+  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
+  version: 4.5.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_451.tgz
+- uid: 2890
+  title: Splunk Machine Learning Toolkit
+  appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
+  version: 5.4.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
+- uid: 2734
+  title: URL Toolbox
+  appid: URL_TOOLBOX
+  version: 1.9.2
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
+githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
+
@@ -1,253 +0,0 @@
-version_control_config:
-  target_branch: develop
-infrastructure_config:
-  infrastructure_type: container
-  full_image_path: registry.hub.docker.com/splunk/splunk:latest
-post_test_behavior: pause_on_failure
-mode: changes
-detections_list: null 
-splunkbase_username: null
-splunkbase_password: null
-apps:
- uid: 1621
-  appid: Splunk_SA_CIM
-  title: Splunk Common Information Model (CIM)
-  description: null
-  release: 5.2.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_520.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 6553
-  appid: Splunk_TA_okta_identity_cloud
-  title: Splunk Add-on for Okta Identity Cloud
-  description: null
-  release: 2.1.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-okta-identity-cloud_210.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 6176
-  appid: Splunk_TA_linux_sysmon
-  title: Add-on for Linux Sysmon
-  description: null
-  release: 1.0.4
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
-# The Following TA does NOT exist on Splunkbase.  It fixes a parsing issue that occurs when raw xmlwineventlog events 
-# are replayed together at a HEC endpoint. This issue does not exist when logs are sent by a Universal Forwarder
- uid: 9999
-  appid: Splunk_FIX_XMLWINEVENTLOG_HEC_PARSING
-  title: Splunk Fix XmlWinEventLog HEC Parsing
-  description: null
-  release: 0.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 742
-  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS
-  title: Splunk Add-on for Microsoft Windows
-  description: null
-  release: 8.8.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_880.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5709
-  appid: Splunk_TA_microsoft_sysmon
-  title: Splunk Add-on for Sysmon
-  description: null
-  release: 4.0.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_400.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 833
-  appid: Splunk_TA_nix
-  title: Splunk Add-on for Unix and Linux
-  description: null
-  release: 9.0.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_900.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5579
-  appid: Splunk_TA_CrowdStrike_FDR
-  title: Splunk Add-on for CrowdStrike FDR
-  description: null
-  release: 1.5.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_150.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3185
-  appid: SPLUNK_TA_FOR_IIS
-  title: Splunk Add-on for Microsoft IIS
-  description: null
-  release: 1.3.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_130.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 4242
-  appid: SPLUNK_TA_FOR_SURICATA
-  title: TA for Suricata
-  description: null
-  release: 2.3.4
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5466
-  appid: SPLUNK_TA_FOR_ZEEK
-  title: TA for Zeek
-  description: null
-  release: 1.0.6
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_106.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3258
-  appid: SPLUNK_ADD_ON_FOR_NGINX
-  title: Splunk Add-on for NGINX
-  description: null
-  release: 3.2.2
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_322.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5238
-  appid: SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS
-  title: Splunk Add-on for Stream Forwarders
-  description: null
-  release: 8.1.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_811.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5234
-  appid: SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA
-  title: Splunk Add-on for Stream Wire Data
-  description: null
-  release: 8.1.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_811.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 2757
-  appid: PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK
-  title: Palo Alto Networks Add-on for Splunk
-  description: null
-  release: 8.1.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_811.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3865
-  appid: TA-Zscaler_CIM
-  title: Zscaler Technical Add-On for Splunk
-  description: null
-  release: 4.0.3
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/zscaler-technical-add-on-for-splunk_403.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3719
-  appid: SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE
-  title: Splunk Add-on for Amazon Kinesis Firehose
-  description: null
-  release: 1.3.2
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 1876
-  appid: Splunk_TA_aws
-  title: Splunk Add-on for AWS
-  description: null
-  release: 7.5.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-web-services-aws_750.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3088
-  appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM
-  title: Splunk Add-on for Google Cloud Platform
-  description: null
-  release: 4.4.0
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_440.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 5556
-  appid: SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE
-  title: Splunk Add-on for Google Workspace
-  description: null
-  release: 2.6.3
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_263.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 3110
-  appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
-  title: Splunk Add-on for Microsoft Cloud Services
-  description: null
-  release: 5.2.2
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_522.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 4055
-  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
-  title: Splunk Add-on for Microsoft Office 365
-  description: null
-  release: 4.5.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_451.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 2890
-  appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
-  title: Splunk Machine Learning Toolkit
-  description: null
-  release: 5.4.1
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
- uid: 2734
-  appid: URL_TOOLBOX
-  title: URL Toolbox
-  description: null
-  release: 1.9.2
-  local_path: null
-  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
-  splunkbase_path: null
-  environment_path: ENVIRONMENT_PATH_NOT_SET
-  force_local: false
@@ -11,6 +11,5 @@ scheduling:
  schedule_window: auto
 alert_action:
  rba:
-    enabled: 'true'
-tags:
-  type: Anomaly
+    enabled: true
+type: Anomaly
@@ -8,5 +8,4 @@ scheduling:
  earliest_time: -1450m@m
  latest_time: -10m@m
  schedule_window: auto
-tags:
-  type: Baseline
+type: Baseline
@@ -16,5 +16,4 @@ alert_action:
    nes_fields: 
    - user
    - dest
-tags:
-  type: 'Correlation'
+type: Correlation
@@ -8,5 +8,4 @@ scheduling:
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
-tags:
-  type: Hunting
+type: Hunting
@@ -17,6 +17,5 @@ alert_action:
    - user 
    - dest
  rba:
-    enabled: 'true'
-tags:
-  type: TTP
+    enabled: true
+type: TTP
@@ -15,19 +15,22 @@ search: '| tstats `security_content_summariesonly` count values(All_Email.recipi
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Email")`
  | eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name) | search space_ratio
  >= 0.1 |  rex field=recipient_address "(?<recipient_user>.*)@" | `email_attachments_with_lots_of_spaces_filter`'
-how_to_implement: "You need to ingest data from emails. Specifically, the sender's\
-  \ address and the file names of any attachments must be mapped to the Email data\
-  \ model. The threshold ratio is set to 10%, but this value can be configured to\
-  \ suit each environment. \\\n **Splunk Phantom Playbook Integration**\\\nIf Splunk\
-  \ Phantom is also configured in your environment, a playbook called \"Suspicious\
-  \ Email Attachment Investigate and Delete\" can be configured to run when any results\
-  \ are found by this detection search. To use this integration, install the Phantom\
-  \ App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname\
-  \ to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring\
-  \ this detection search. The notable event will be sent to Phantom and the playbook\
-  \ will gather further information about the file attachment and its network behaviors.\
-  \ If Phantom finds malicious behavior and an analyst approves of the results, the\
-  \ email will be deleted from the user's inbox."
+how_to_implement: 'You need to ingest data from emails. Specifically, the sender''s
+  address and the file names of any attachments must be mapped to the Email data
+  model. The threshold ratio is set to 10%, but this value can be configured to
+  suit each environment.
+  
+  **Splunk Phantom Playbook Integration**
+  
+  If Splunk Phantom is also configured in your environment, a playbook called "Suspicious
+  Email Attachment Investigate and Delete" can be configured to run when any results
+  are found by this detection search. To use this integration, install the Phantom
+  App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname
+  to the "Phantom Instance" field in the Adaptive Response Actions when configuring
+  this detection search. The notable event will be sent to Phantom and the playbook
+  will gather further information about the file attachment and its network behaviors.
+  If Phantom finds malicious behavior and an analyst approves of the results, the
+  email will be deleted from the user''s inbox.'
 known_false_positives: None at this time
 references: []
 tags:
@@ -17,7 +17,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 60
  impact: 80
  message: A user [$user$] has failed to authenticate via MFA from IP Address - [$src$]"
@@ -17,7 +17,7 @@ references:
 tags:
  analytic_story:
  - Suspicious Okta Activity
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 90
  impact: 90
  message: A user [$user$] is attempting IDP lifecycle modification - [$description$] from IP Address - [$src$]"
@@ -33,7 +33,7 @@ tags:
  analytic_story:
  - Okta Account Takeover
  - Okta MFA Exhaustion
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 60
  impact: 30
  message: $user$ account has rejected multiple Okta pushes.
@@ -6,24 +6,24 @@ author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
 type: TTP
 status: experimental
 data_source: []
-description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.

-  For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+  For each Okta Verify Push challenge, the following two events are recorded in Okta System Log 
  
-  Source of Push (Sign-In) \
+  Source of Push (Sign-In) 

-  eventType eq \"system.push.send_factor_verify_push\" \
+  eventType eq \"system.push.send_factor_verify_push\" 

-  User Push Response (Okta Verify client) \
+  User Push Response (Okta Verify client) 

-  eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+  eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" 

-  In sequence, the logic for the analytic - \
+  In sequence, the logic for the analytic - 
  
-  * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+  * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) 

-  * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \
-  * Creates a ratio of successful sign-ins to pushes. \
+  * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. 
+  * Creates a ratio of successful sign-ins to pushes. 

  * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.'
 search: '`okta` eventType IN (system.push.send_factor_verify_push) OR
@@ -64,7 +64,7 @@ tags:
  analytic_story:
  - Okta Account Takeover
  - Okta MFA Exhaustion
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 80
  impact: 80
  message: A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
@@ -21,7 +21,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 60
  impact: 50
  message: MFA was disabled for User [$user$] initiated by [$src$]. Investigate further to determine if this was authorized.
@@ -8,7 +8,7 @@ type: Anomaly
 status: production
 description: The following analytic utilizes the user.acount.lock event to identify multiple Okta accounts locking out in a short period of time. An adversary attempting to brute force or password spray account names may lock accounts out depending on the threshold set by the organization. Monitoring for multiple account lockouts can help detect potential account takeover attempts or unauthorized access to Okta accounts.
 search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime values(All_Changes.user) as user
-  from datamodel=Change where All_Changes.change_type=AAA All_Changes.object_category=User AND All_Changes.action=modified AND All_Changes.command=user.account.lock by _time span=5m All_Changes.result All_Changes.command sourcetype All_Changes.src
+  from datamodel=Change where All_Changes.change_type=AAA All_Changes.object_category=User AND All_Changes.action=lockout AND All_Changes.command=user.account.lock by _time span=5m All_Changes.result All_Changes.command sourcetype All_Changes.src
  | where count > 5
  | `drop_dm_object_name("All_Changes")`
  | `security_content_ctime(firstTime)` 
@@ -22,7 +22,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 70
  impact: 70
  message: Multiple accounts locked out in Okta from [$src$]. Investigate further to determine if this was authorized.
@@ -21,7 +21,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 70
  impact: 60
  message: Multiple failed MFA requests for user [$src_user$] from IP Address - [$src_ip$]. Investigate further to determine if this was authorized.
@@ -7,14 +7,14 @@ type: Hunting
 status: experimental
 data_source: []
 description:
-  'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \
-  * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+  'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: 
+  * Retrieves policy evaluation and SSO details in events that contain the Application requested 

-  * Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+  * Formats target fields so we can aggregate specifically on Applications (AppInstances) 

-  * Groups by User, Session and IP \
+  * Groups by User, Session and IP 

-  * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+  * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies 

  * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
 search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip(''target{}.type'', ''target{}.displayName'', ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
@@ -26,7 +26,7 @@ references:
 tags:
  analytic_story:
    - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 70
  impact: 80
  message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$.
@@ -22,7 +22,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 90
  impact: 60
  message: Multiple users failing to authenticate from a single source IP Address - [$src$]. Investigate further to determine if this was authorized.
@@ -22,7 +22,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 80
  impact: 80
  message: A new API token was created in Okta by [$user$]. Investigate further to determine if this was authorized.
@@ -1,7 +1,7 @@
 name: Okta New Device Enrolled on Account
 id: bb27cbce-d4de-432c-932f-2e206e9130fb
 version: 2
-date: '2024-03-8'
+date: '2024-03-08'
 author: Michael Haag, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -21,7 +21,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 60
  impact: 40
  message: A new device was enrolled on an Okta account for user [$user$]. Investigate further to determine if this was authorized.
@@ -22,7 +22,7 @@ tags:
    - Okta Account Takeover
    - Okta MFA Exhaustion
    - Suspicious Okta Activity
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 80
  impact: 70
  message: Okta Risk threshold exceeded for user [$risk_object$]. Investigate further to determine if this was authorized.
@@ -18,7 +18,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 60
  impact: 80
  message: A user [$user$] has successfully logged in to Okta Dashboard with single factor authentication from IP Address - [$src_ip$].
@@ -20,7 +20,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 50
  impact: 50
  message: A user [$user$] reported suspicious activity in Okta. Investigate further to determine if this was authorized.
@@ -6,11 +6,11 @@ author: Scott Dermott, Felicity Robson, Okta, Michael Haag, Bhavin Patel, Splunk
 type: Anomaly
 status: production
 data_source: []
-description: 'This analytic identifies instances where multiple client attributes (such as IP, User Agent, etc.) associated with the same Device Token change for a specific user. It aims to detect scenarios where an adversary might attempt to reuse a stolen web session cookie. \
+description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. 

-  * It retrieves policy evaluation events from successful authentication attempts. \
+  * Retrieves policy evaluation events from successful authentication events. 

-  * It aggregates and groups these events by Device Token and User, providing the first policy evaluation event within the search window. \
+  * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. 

  * It checks for the presence of more than one IP and whether there are multiple OS or browsers for each User/Device Token combination.'
 search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN
@@ -30,7 +30,7 @@ tags:
  analytic_story:
  - Suspicious Okta Activity
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 70
  impact: 80
  message: A user [$user$] is attempting to use a session cookie from multiple IP addresses or devices. Investigate further to determine if this was authorized.
@@ -19,7 +19,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 90
  impact: 90
  message: A user [$user$] is attempting to access an unauthorized application from IP Address - [$src$]
@@ -21,7 +21,7 @@ references:
 tags:
  analytic_story:
  - Okta Account Takeover
-  asset_type: Okta tenant
+  asset_type: Okta Tenant
  confidence: 90
  impact: 90
  message: A user [$user$] has logged in from multiple cities [$City$] from IP Address - [$src$]. Investigate further to determine if this was authorized.
@@ -28,7 +28,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities 
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 70
  impact: 50
  message: Possible attack against splunk_server $splunk_server$ through abuse of the runshellscript command
@@ -26,7 +26,7 @@ cve:
 tags:
  analytic_story:
    - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 2
  impact: 50
  message: Please review $eai:acl.app$ for possible malicious lookups
@@ -21,7 +21,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Splunk Server
  confidence: 100
  cve:
  - CVE-2024-29945
@@ -1,7 +1,7 @@
 name: Splunk Data exfiltration from Analytics Workspace using sid query
 id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8
 version: 1
-date: 2022-11-1
+date: '2022-11-01'
 author: Rod Soto, Eric McGinnis
 status: production
 type: Hunting
@@ -35,7 +35,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 80
  cve:
  - CVE-2022-32151
@@ -15,7 +15,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities 
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 30
  impact: 50
  message: Possible DoS attack against Splunk Server $splunk_server$
@@ -16,7 +16,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 100
  impact: 100
@@ -17,7 +17,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 100
  impact: 100
  message: Possible denial of service attack against $host$
@@ -16,7 +16,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities 
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 80
  impact: 80
@@ -7,7 +7,7 @@ status: production
 type: TTP
 data_source: []
 description: In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.
-search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error | stats count min(_time) as firstTime max(_time) as lastTime by user method msg 
+search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error | stats count min(_time) as firstTime max(_time) as lastTime by user host method msg 
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` 
  | `splunk_es_dos_investigations_manager_via_investigation_creation_filter`'
@@ -30,7 +30,11 @@ tags:
  - name: user
    type: User 
    role:
-    - Attacker
+    - Victim
+  - name: host
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise Security
  risk_score: 100
@@ -16,7 +16,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities 
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 50
  impact: 50
@@ -17,7 +17,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 90
  impact: 90
@@ -17,7 +17,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint 
+  asset_type: Endpoint 
  atomic_guid: []
  confidence: 80
  impact: 50
@@ -16,7 +16,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 20
  impact: 80
@@ -16,7 +16,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities 
-  asset_type: endpoint
+  asset_type: Endpoint
  atomic_guid: []
  confidence: 50
  impact: 30
@@ -31,7 +31,7 @@ cve:
 tags:
  analytic_story:
    - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 80
  impact: 80
  message: Potential Remote Code Execution via XLST from $src$ using useragent - $useragent$
@@ -15,7 +15,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 40
  impact: 30
  message: Possible XSS attack against from $user$
@@ -24,7 +24,7 @@ references:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 80
  cve:
  - CVE-2021-33845
@@ -25,7 +25,7 @@ cve:
 tags:
  analytic_story:
  - Splunk Vulnerabilities
-  asset_type: endpoint
+  asset_type: Endpoint
  confidence: 50
  impact: 30
  message: Possible XSS exploitation from $clientip$
@@ -13,18 +13,22 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  All_Email.file_name All_Email.message_id | `security_content_ctime(firstTime)` |
  `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Email")` | `suspicious_email_attachments`
  | `suspicious_email_attachment_extensions_filter` '
-how_to_implement: "You need to ingest data from emails. Specifically, the sender's\
-  \ address and the file names of any attachments must be mapped to the Email data\
-  \ model. \\\n **Splunk Phantom Playbook Integration**\\\nIf Splunk Phantom is also\
-  \ configured in your environment, a Playbook called \"Suspicious Email Attachment\
-  \ Investigate and Delete\" can be configured to run when any results are found by\
-  \ this detection search. To use this integration, install the Phantom App for Splunk\
-  \ `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the\
-  \ \"Phantom Instance\" field in the Adaptive Response Actions when configuring this\
-  \ detection search. The notable event will be sent to Phantom and the playbook will\
-  \ gather further information about the file attachment and its network behaviors.\
-  \ If Phantom finds malicious behavior and an analyst approves of the results, the\
-  \ email will be deleted from the user's inbox."
+how_to_implement: You need to ingest data from emails. Specifically, the sender's
+  address and the file names of any attachments must be mapped to the Email data
+  model.
+  
+  **Splunk Phantom Playbook Integration**
+  
+  If Splunk Phantom is also
+  configured in your environment, a Playbook called "Suspicious Email Attachment
+  Investigate and Delete" can be configured to run when any results are found by
+  this detection search. To use this integration, install the Phantom App for Splunk
+  `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the
+  "Phantom Instance" field in the Adaptive Response Actions when configuring this
+  detection search. The notable event will be sent to Phantom and the playbook will
+  gather further information about the file attachment and its network behaviors.
+  If Phantom finds malicious behavior and an analyst approves of the results, the
+  email will be deleted from the user's inbox.'
 known_false_positives: None identified
 references: []
 tags:
@@ -22,7 +22,7 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
 how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
  create the probability density function.
-known_false_positives: ''
+known_false_positives: 'None.'
 references: []
 tags:
  analytic_story:
@@ -60,4 +60,4 @@ tags:
  - All_Changes.object_category
  - All_Changes.user
  risk_score: 25
-  security_domain: Cloud
+  security_domain: cloud
@@ -57,4 +57,4 @@ tags:
  - All_Changes.object_category
  - All_Changes.user
  risk_score: 25
-  security_domain: Cloud
+  security_domain: cloud
@@ -23,7 +23,7 @@ search: '| tstats count as security_group_api_calls values(All_Changes.command)
 how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
  run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
  create the probability density function model.
-known_false_positives: ''
+known_false_positives: 'None.'
 references: []
 tags:
  analytic_story:
@@ -1,20 +1,26 @@
 name: AWS Create Policy Version to allow all resources
 id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
-version: 3
-date: '2022-05-17'
+version: 4
+date: '2024-04-16'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
 description: This search looks for AWS CloudTrail events where a user created a policy
-  version that allows them to access any resource in their account.
+  version that allows them to access any resource in their account. A widely open AWS IAM policy, especially in the context of creating a new policy version with the CreatePolicyVersion action, typically grants extensive permissions across a broad range of resources. Such policies are considered risky because they can provide more permissions than necessary, violating the principle of least privilege.
 data_source: []
-search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
-  errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
-  path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements
-  output=key_policy_action_1 path=Action | where key_policy_action_1 = "*" | stats
-  count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements)
-  as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
-  awsRegion user user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
+search: '`cloudtrail` eventName=CreatePolicyVersion  eventSource = iam.amazonaws.com
+    errorCode = success 
+| spath input=requestParameters.policyDocument output=key_policy_statements
+    path=Statement{} 
+| spath input=key_policy_statements output=key_policy_action_1 path=Action 
+| spath input=key_policy_statements output=effect path=Effect | search  effect=Allow 
+| regex key_policy_action_1="^(\*|[\w-]+:\*)$"
+| stats
+    count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements)
+    as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
+    awsRegion user user_arn 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
@@ -39,7 +45,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -31,7 +31,7 @@ tags:
  asset_type: AWS Account
  confidence: 80
  impact: 90
-  message: User $user_arn$ is attempting to create a login profile for $requestParameters.userName$
+  message: User $user_arn$ is attempting to create a login profile for $new_login_profile$
    and did a console login from this IP $src_ip$
  mitre_attack_id:
  - T1136.003
@@ -44,7 +44,7 @@ tags:
  - name: user_arn
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
  key_policy_action_2) | spath input=key_policy_statements output=key_policy_principal
  path=Principal.AWS | search key_policy_action="kms:Encrypt" AND key_policy_principal="*"
  | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource
-  eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
+  eventID awsRegion userIdentity.principalId user | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs
@@ -32,15 +32,15 @@ tags:
  asset_type: AWS Account
  confidence: 50
  impact: 50
-  message: AWS account is potentially compromised and user $userIdentity.principalId$
+  message: AWS account is potentially compromised and user $user$
    is trying to compromise other accounts.
  mitre_attack_id:
  - T1486
  observable:
-  - name: userIdentity.principalId
+  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -36,11 +36,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
-  - name: dest_file
-    type: File
-    role:
-    - Target
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -34,7 +34,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -39,7 +39,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -6,12 +6,12 @@ author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
-description: The following analytic detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
+description: The following analytic detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.

- S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
+  S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
 search: '`cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
-|  rename requestParameters.* as * 
-| stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`'
+  |  rename requestParameters.* as * 
+  | stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.
@@ -24,14 +24,14 @@ tags:
  asset_type: EC2 Snapshot
  confidence: 80
  impact: 80
-  message: AWS Bucket Replication rule $rule$ added on $source_bucket$ to $destination_bucket$ by user $user_arn$ from IP Address - $src_ip$
+  message: AWS Bucket Replication rule $rule_id$ added on $source_bucket$ to $destination_bucket$ by user $user_arn$ from IP Address - $src_ip$
  mitre_attack_id:
  - T1537
  observable:
  - name: user_arn
    type: User
    role:
-    - Attacker
+    - Victim
  - name: src_ip
    type: IP Address
    role:
@@ -35,7 +35,7 @@ tags:
  - name: user_name
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -14,7 +14,7 @@ data_source: []
 search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time
  | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent)
  by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts
-  > 20 | `aws_high_number_of_failed_authentications_from_ip_filter`'
+  > 20 |  `aws_high_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail.
  We recommend the users to try different combinations of the bucket span time and
  the tried account threshold to tune this search according to their environment.
@@ -31,17 +31,12 @@ tags:
  asset_type: AWS Account
  confidence: 90
  impact: 60
-  message: Multiple failed console login attempts against users $tried_accounts$ seen
-    from $src_ip$
+  message: 'Multiple failed console login attempts (Count: $failed_attempts$) against users from IP Address - $src_ip$'
  mitre_attack_id:
  - T1110
  - T1110.003
  - T1110.004
  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
  - name: tried_accounts
    type: User
    role:
@@ -40,7 +40,7 @@ tags:
  - name: userIdentity.arn
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -11,8 +11,8 @@ description: The following analytic identifies one source Ip failing to authenti
  environment tenant to obtain initial access or elevate privileges.
 data_source: []
 search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time
-  | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by
-  _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+  | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time,
+  src_ip |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail.
  We recommend the users to try different combinations of the bucket span time and
  the tried account threshold to tune this search according to their environment.
@@ -29,8 +29,7 @@ tags:
  asset_type: AWS Account
  confidence: 90
  impact: 60
-  message: Multiple failed console login attempts against users $tried_accounts$ seen
-    from $src_ip$
+  message: 'Multiple failed console login attempts (Count: $unique_accounts$) against users from IP Address - $src_ip$'
  mitre_attack_id:
  - T1110
  - T1110.003
@@ -11,7 +11,7 @@ description: This search provides specific SAML access from specific Service Pro
  environments using SAML protocol inside the perimeter or cloud provider.
 data_source: []
 search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
-  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
+  max(_time) as lastTime by eventName requestParameters.principalArn requestParameters.roleArn
  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  |`aws_saml_access_by_provider_user_and_principal_filter`'
@@ -47,7 +47,6 @@ tags:
    type: Other
    role:
    - Victim
-    - Target
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -38,8 +38,7 @@ tags:
  asset_type: AWS Account
  confidence: 90
  impact: 60
-  message: Unusual number of failed console login attempts against users $tried_accounts$
-    seen from $src_ip$
+  message: 'Unusual number of failed console login attempts (Count: $distinct_attempts$) against users from IP Address - $src_ip$'
  mitre_attack_id:
  - T1586
  - T1586.003
@@ -40,7 +40,7 @@ tags:
  - name: src_user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -30,7 +30,7 @@ references:
 tags:
  analytic_story:
  - Azure Active Directory Account Takeover
-  asset_type: Azure AD
+  asset_type: Azure Tenant
  confidence: 50
  impact: 60
  message: User $user$ disabled the BlockUserConsentForRiskyApps Azure AD setting.
@@ -40,7 +40,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -35,7 +35,7 @@ tags:
  analytic_story:
  - Compromised User Account
  - Azure Active Directory Account Takeover
-  asset_type: Azure AD
+  asset_type: Azure Tenant
  confidence: 60
  impact: 70
  message: User $user$ has concurrent sessions from more than one unique
@@ -34,7 +34,7 @@ references:
 tags:
  analytic_story:
  - Azure Active Directory Account Takeover
-  asset_type: Azure AD
+  asset_type: Azure Tenant
  confidence: 50
  impact: 70
  message: Device code requested for $user$ from $src_ip$
@@ -41,7 +41,7 @@ tags:
  - name: user
    type: User
    role:
-    - Attacker
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -55,4 +55,5 @@ tests:
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/full_access_as_app_permission_assigned.log
    sourcetype: azure:monitor:aad
+    source: Azure AD
    update_timestamp: true
@@ -31,7 +31,7 @@ tags:
  analytic_story:
  - Compromised User Account
  - Azure Active Directory Account Takeover
-  asset_type: Azure AD
+  asset_type: Azure Tenant
  confidence: 70
  impact: 50
  message: User $user$ failed to authenticate more than 20 times in the
--- a/Show More
+++ b/Show More