diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 0b9e44dd38..eaa69b3371 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -69,5 +69,3 @@ tags: - All_Changes.user risk_score: 36 security_domain: threat - supported_tas: - - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index bdc4b42232..69d089c8c1 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -69,5 +69,3 @@ tags: - All_Changes.user risk_score: 30 security_domain: threat - supported_tas: - - Splunk_TA_aws-kinesis-firehose diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index aba210b24e..e34acb1e96 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -40,7 +40,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 80 context: - Source:Endpoint @@ -76,6 +76,4 @@ tags: - Registry.registry_value_name risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index d30954b5a0..9aa9e0d82a 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -74,6 +74,4 @@ tags: - Registry.user risk_score: 3 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 34c1cdecce..59e0e60ef8 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -31,7 +31,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -67,6 +67,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 7002c61662..d5a0409e7c 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -64,8 +64,6 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4aace03422..4508894ffc 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index b5b16d85d0..52e5e64bf4 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index b55567d231..7c3c00e2a6 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 15558e4857..e615625cef 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index dcd559b377..0b0ca7d63b 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -69,6 +69,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index f4d6e75115..6f9edd6e53 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -69,6 +69,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index bd0cb4a173..34708edcd8 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -63,8 +63,6 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index f103d447f3..60016c024f 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index cfe318454b..0c268b1755 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -70,6 +70,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 7274da1be8..5f36ad8bfb 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -74,6 +74,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 27e511a6ca..008c8d940a 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6ea9d3374a..9006a4e342 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -72,6 +72,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 1784fcf94e..fb73ca5935 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 9194625692..8d7c5fc76e 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -72,6 +72,4 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index dd31cbbe30..d1bcc23391 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 552d04ef06..4f2d135f99 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 3c65b3339d..1fedab8198 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -73,6 +73,4 @@ tags: - Registry.registry_value_name risk_score: 42 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 897386f6a7..966883bf51 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 828b657127..11264a30e1 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -75,6 +75,4 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 56af0e84d8..d613e31276 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -38,7 +38,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -76,6 +76,4 @@ tags: - Registry.registry_value_data risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index e4c6563593..6dbfcc342b 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -79,6 +79,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index a29cb171b9..0e5d0129b5 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -35,7 +35,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Double Zero Destructor + - Double Zero Destructor - Data Destruction - XMRig - Remcos @@ -82,6 +82,4 @@ tags: - Filesystem.user risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 46e8bea28d..29b0696999 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -64,6 +64,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index b7bd73fc7f..26fe1e9e44 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process_name risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 043e3410ed..a5b5b822a9 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -55,8 +55,6 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c5a14cb897..7c25700d37 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -98,5 +98,3 @@ tags: - Registry.user risk_score: 76 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5028c90de0..af7fb3ca92 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -62,6 +62,4 @@ tags: - Registry.user risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index e0ae661df2..f67169a505 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -71,6 +71,4 @@ tags: - Registry.registry_key_name risk_score: 60 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index fc1f7a21f5..e1d11e5967 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_name risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 2c40265a4a..93d17df1aa 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index b32d2605da..743596ddef 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -32,7 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 90 context: - Source:Endpoint @@ -68,6 +68,4 @@ tags: - Registry.registry_value_name risk_score: 72 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 1ba358eda6..40df19bf94 100644 --- a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -94,5 +94,3 @@ tags: - cmd_line risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 44b59e6cc7..094d60fcf0 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -39,7 +39,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint @@ -75,6 +75,4 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 5c350e3f69..0fda897324 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -74,6 +74,4 @@ tags: - Registry.registry_value_data risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index eaf42461b5..4e4eff11f6 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -6,13 +6,15 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. - This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. - This technique was used by threat actor to make its payload more impactful to the compromised host. +description: This analytic is to detect a suspicious registry modification to disable + Lock Computer windows features. This registry modification prevent the user from + locking its screen or computer that are being abused by several malware for example + ransomware. This technique was used by threat actor to make its payload more impactful + to the compromised host. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -21,15 +23,14 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_lock_workstation_feature_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ -- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ +- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ +- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ tags: analytic_story: - Ransomware @@ -51,17 +52,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +78,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 1d42ed5b62..0e9dbda9bf 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -6,33 +6,35 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. - This registry when enable will prevent users to log off of the system by using any method, - including programs run from the command line, such as scripts. It also disables or removes - all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware - to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +description: This analytic is to detect a suspicious registry modification to disable + logoff feature in windows host. This registry when enable will prevent users to + log off of the system by using any method, including programs run from the command + line, such as scripts. It also disables or removes all menu items and buttons that + log the user off of the system. This technique was seen abused by ransomware malware + to make the compromised host un-useful and hard to remove other registry modification + made on the machine that needs restart to take effect. This windows feature may + implement by administrator in some server where shutdown is critical. In that scenario + filter of machine and users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_logoff_button_through_registry_filter`' + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data + = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, + _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_guid | + `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name + parent_process process_name process_path process proc_guid registry_path registry_value_name + registry_value_data | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp @@ -57,17 +59,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -84,4 +85,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 835040e6b0..ed35c9bdca 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. - This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host - un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +description: This analytic is to detect a suspicious registry modification to disable + shutdown button on the logon user. This technique was seen in several malware especially + in ransomware family like killdisk malware variant to make the compromised host + un-useful and hard to remove other registry modification made on the machine that + needs restart to take effect. This windows feature may implement by administrator + in some server where shutdown is critical. In that scenario filter of machine and + users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" - Registry.registry_value_data = "0x00000000") - OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" + Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,15 +26,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_shutdown_button_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ tags: analytic_story: - Ransomware @@ -53,17 +55,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -80,4 +81,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 1dcf8918c4..8fb1dcd2b8 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable windows features. - These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response - from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but - can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed. +description: This analytic is to detect a suspicious registry modification to disable + windows features. These techniques are seen in several ransomware malware to impair + the compromised host to make it hard for analyst to mitigate or response from the + attack. Disabling these known features make the analysis and forensic response more + hard. Disabling these feature is not so common but can still be implemented by the + administrator for security purposes. In this scenario filters for users that are + allowed doing this is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" - Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", - "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" + Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", + "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,8 +28,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_windows_group_policy_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. @@ -55,17 +58,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -82,4 +84,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index af508a8574..4ea865b840 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -68,5 +68,3 @@ tags: - Registry.registry_path risk_score: 24 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6f5e2c783a..8952b7a5ad 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -6,30 +6,32 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. - This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and - ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed. +description: This analytic is to detect a suspicious registry modification to hide + common windows notification feature from compromised host. This technique was seen + in some ransomware family to add more impact to its payload that are visually seen + by user aside from the encrypted files and ransomware notes. Even this a good anomaly + detection, administrator may implement this changes for auditing or security reason. + In this scenario filter is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", + "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by + _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_hide_notification_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ tags: analytic_story: - Ransomware @@ -51,17 +53,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +79,6 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 557b7b6812..10eaec97a3 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -7,25 +7,25 @@ type: TTP datamodel: - Endpoint description: The following analytic detects programs that have been started by forfiles.exe. - According to Microsoft, the 'The forfiles command lets you run a command on or pass + According to Microsoft, the 'The forfiles command lets you run a command on or pass arguments to multiple files'. While this tool can be used to start legitimate programs, - usually within the context of a batch script, it has been observed being used to evade - protections on command line execution. + usually within the context of a batch script, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_forfiles_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* + /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where forfiles.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. - Similarly, forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, + forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles tags: analytic_story: - Living Off The Land @@ -43,21 +43,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -70,5 +69,7 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 6e29b08e87..e89f30e86d 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -6,24 +6,25 @@ author: Eric McGinnis, Splunk type: TTP datamodel: - Endpoint -description: The following analytic detects programs that have been started by pcalua.exe. - pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this tool - can be used to start legitimate programs, it has been observed being used to evade - protections on command line execution. +description: The following analytic detects programs that have been started by pcalua.exe. + pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this + tool can be used to start legitimate programs, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_pcalua_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* + -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where pcalua.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Filter + these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ tags: analytic_story: - Living Off The Land @@ -41,21 +42,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -68,5 +68,7 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index c7538027c5..25a12aebf3 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -74,3 +74,5 @@ tags: risk_score: 25 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 8d08e15fbd..8e1484f3ae 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -76,3 +76,5 @@ tags: risk_score: 49 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index a0dde062a7..20db8bc840 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -79,3 +79,5 @@ tags: risk_score: 80 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 7d59343cd5..ae5107d202 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -76,3 +76,5 @@ tags: risk_score: 80 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index f8e182e452..ccf62a7fd0 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -73,3 +73,5 @@ tags: risk_score: 48 security_domain: endpoint asset_type: Endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/security_content_automation/detection_ta_mapping.csv b/security_content_automation/detection_ta_mapping.csv index 4ce0deb0aa..2a7e152f93 100644 --- a/security_content_automation/detection_ta_mapping.csv +++ b/security_content_automation/detection_ta_mapping.csv @@ -1,317 +1,331 @@ detection_name,cim_version,supported_tas,tas_with_cim_mapping -abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" -possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon -disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" -linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" +abnormally_high_number_of_cloud_security_group_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_api_calls_from_previously_unseen_user_roles,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_in_previously_unused_region,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_country,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_by_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_region,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_provisioning_from_previously_unseen_city,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_provisioning_from_previously_unseen_ip_address,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +cloud_instance_modified_with_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +linux_setuid_using_chmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_folderoptions_windows_feature,5.0.1,,Splunk_TA_bit9-carbonblack +anomalous_usage_of_7zip,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +enable_rdp_in_other_port_number,5.0.1,,Splunk_TA_bit9-carbonblack +excessive_number_of_taskhost_processes,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +xsl_script_execution_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +rundll32_control_rundll_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_kworker_process_commandline,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disable_schedule_task,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +serviceprincipalnames_discovery_with_setspn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_operation_with_consent_admin,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_service_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +spoolsv_writing_a_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_deletion_of_cron_jobs,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dsquery_domain_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_possible_access_or_modification_of_sshd_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_file_without_extension_in_critical_folder,5.0.1,,Splunk_TA_bit9-carbonblack +secretdumps_offline_ntds_dumping_tool,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attacker_tools_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_deletion_of_ssl_certificate,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +domain_account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +certutil_exe_certificate_extraction,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +prevent_automatic_repair_mode_using_bcdedit,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_possible_access_to_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +get_domainpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +disable_registry_tool,5.0.1,,Splunk_TA_bit9-carbonblack +powershell_disable_security_monitoring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +svchost_exe_lolbas_execution_process_spawn,5.0.1,,Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_download_with_verifyctl_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_nirsoft_advancedrun,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +cmd_echo_pipe___escalation,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_number_of_service_control_start_as_disabled,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_installutil_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_memory_crash_dump,5.0.1,,Splunk_TA_bit9-carbonblack +detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_icedid_rundll32_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_service_stop_attempt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_copy_on_system32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +credential_dumping_via_symlink_to_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_indirect_command_execution_via_pcalua,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_searchprotocolhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +permission_modification_using_takeown_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_at_application_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +reg_exe_manipulating_windows_services_registry_keys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +logon_script_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +linux_possible_ssh_key_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dump_lsass_via_procdump,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +getwmiobject_ds_computer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sdclt_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +hide_user_account_from_sign_in_screen,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +deleting_of_net_users,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +revil_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack +detect_psexec_with_accepteula_flag,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_dcom_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +auto_admin_logon_registry_entry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_high_frequency_of_file_deletion_in_etc_folder,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_doas_tool_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +modify_acl_permission_to_files_or_folder,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +getdomaingroup_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_amsi_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +wermgr_process_spawned_cmd_or_powershell_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_azurehound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_rundll32_with_no_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_hide_notification_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_exchange_web_shell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +time_provider_persistence_registry,5.0.1,,Splunk_TA_bit9-carbonblack +system_processes_run_from_unexpected_locations,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +scheduled_task_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sc_exe_manipulating_windows_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +ryuk_wake_on_lan_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_remote_assistance_spawning_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_access_to_credential_files,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +suspicious_wevtutil_usage,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +excessive_usage_of_cacls_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_task_manager,5.0.1,,Splunk_TA_bit9-carbonblack +office_document_spawned_child_process_to_download,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +processes_launching_netsh,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_possible_append_command_to_at_allow_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +single_letter_process_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +check_elevated_cmd_using_whoami,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +short_lived_windows_accounts,5.0.1,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" +possible_lateral_movement_powershell_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_windows_group_policy_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +schtasks_scheduling_job_on_remote_system,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_deletion_of_services,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +executables_or_script_creation_in_suspicious_path,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +active_setup_registry_autostart,5.0.1,,Splunk_TA_bit9-carbonblack +suspicious_rundll32_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_regsvr32_register_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_install_kernel_module_using_modprobe_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +scheduled_task_creation_on_remote_endpoint_using_at,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_profile_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +nishang_powershelltcponeline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_sudoers_tmp_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_linux_discovery_commands,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_service_restarted,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +getwmiobject_ds_group_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +firewall_allowed_program_enable,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_application_spawn_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_gpupdate_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +extraction_of_registry_hives,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +powershell_start_bitstransfer,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___setupapi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_aduserresultantpasswordpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_dotnet_binary_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +net_profiler_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_etw_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +remote_process_instantiation_via_winrm_and_winrs,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_process_instantiation_via_winrm_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_process_file_path,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +any_powershell_downloadstring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_change_file_owner_to_root,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +process_creating_lnk_file_in_suspicious_location,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_disable_lock_workstation_feature_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wbadmin_delete_system_backups,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_pkexec_privilege_escalation,5.0.1,,Splunk_TA_microsoft_sysmon +disabling_controlpanel,5.0.1,,Splunk_TA_bit9-carbonblack +attempt_to_stop_security_service,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excel_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_inbound_traffic_by_firewall_rule_registry,5.0.1,,Splunk_TA_bit9-carbonblack +getdomaincomputer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +malicious_powershell_process___execution_policy_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +fodhelper_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_regsvr32_application_control_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_curl_download_to_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_microsoft_workflow_compiler_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bcdedit_failure_recovery_modification,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_service_file_created_in_systemd_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +slui_runas_elevated,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +batch_file_write_to_system32,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_dism_remove_defender,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_taskkill,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +nltest_domain_trust_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +fsutil_zeroing_file,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_modify_show_compress_color_and_info_tip_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_application_spawn_rundll32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +add_or_set_windows_defender_exclusion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bitsadmin_download_file,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_path_interception_by_creation_of_program_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +cmdline_tool_not_executed_in_cmd_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_startw,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +script_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +slui_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +scheduled_task_deleted_or_created_via_cmd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +allow_network_discovery_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_created_in_kernel_driver_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_logs_using_wevtutil,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +revil_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +excessive_distinct_processes_from_windows_temp,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +detect_sharphound_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wmiprsve_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_creation_in_profile_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_service_creation_using_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack +services_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +regsvr32_with_known_silent_switch_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +deleting_shadow_copies,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winhlp32_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_firewall_with_netsh,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_net,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_setuid_using_setcap_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_preload_hijack_library_calls,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_installutil_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_adfind_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +disabling_cmd_application,5.0.1,,Splunk_TA_bit9-carbonblack +msmpeng_application_dll_side_loading,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_insert_kernel_module_using_insmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +certutil_download_with_urlcache_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +uninstall_app_using_msiexec,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +execute_javascript_with_jscript_com_clsid,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +create_local_admin_accounts_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_shutdown_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_doas_conf_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +creation_of_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_logoff_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_file_creation_in_init_boot_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_disableantispyware_reg,5.0.1,,Splunk_TA_bit9-carbonblack +getwmiobject_ds_user_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +disable_windows_app_hotkeys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dns_exfiltration_using_nslookup_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +clear_unallocated_sector_using_cipher_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_java_spawning_shell,5.0.1,,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_domaintrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_credential_theft,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_used_for_persistence,5.0.1,,Splunk_TA_bit9-carbonblack +detect_rundll32_application_control_bypass___syssetup,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +ping_sleep_batch_command,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_system_network_discovery,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +detect_processes_used_for_system_network_configuration_discovery,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +clop_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_certutil,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +regsvr32_silent_and_install_param_dll_loading,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +rubeus_command_line_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +msbuild_suspicious_spawned_by_script_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +hiding_files_and_directories_with_attrib_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawn_cmd_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsreset_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +certutil_with_decode_argument,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_file_and_printing_sharing_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +system_information_discovery_detection,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +malicious_powershell_process_with_obfuscation_techniques,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_add_files_in_known_crontab_directories,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +eventvwr_uac_bypass,5.0.1,,Splunk_TA_bit9-carbonblack +icacls_deny_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +usn_journal_deletion,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_system_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_using_infotech_storage_handlers,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sdelete_application_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +curl_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +icacls_grant_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +rundll_loading_dll_by_ordinal,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_disable_change_password_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack +credential_dumping_via_copy_command_from_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +control_loading_from_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_dllhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +spoolsv_spawning_rundll32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +conti_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +attempted_credential_dump_from_registry_via_reg_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +jscript_execution_using_cscript_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +bcdedit_command_back_to_normal_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +rundll32_shimcache_flush,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +screensaver_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +office_product_spawning_bitsadmin,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_default_file_association,5.0.1,,Splunk_TA_bit9-carbonblack +linux_deletion_of_ssh_key,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wscript_or_cscript_suspicious_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_controller_discovery_with_nltest,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_windows_behavior_monitoring,5.0.1,,Splunk_TA_bit9-carbonblack +windows_curl_upload_to_remote_destination,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unified_messaging_service_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_html_help_spawn_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_service_started_or_enabled,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +java_class_file_download_by_java_user_agent,5.0.1,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" +linux_at_allow_config_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_stdout_redirection_to_dev_null_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_visudo_utility_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +schtasks_run_task_on_demand,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_iptables_firewall_modification,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +schtasks_used_for_forcing_a_reboot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_raccine_scheduled_task_deletion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mshta_spawning_rundll32_or_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +excessive_attempt_to_disable_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +get_domainuser_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_scheduled_task_from_public_directory,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +rundll32_with_no_command_line_arguments_with_network,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_creation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_nopasswd_entry_in_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +attempt_to_add_certificate_to_untrusted_store,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +process_kill_base_on_file_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_deletion_of_init_daemon_script,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wsmprovhost_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_account_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_dd_file_overwrite,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +disabling_norun_windows_app,5.0.1,,Splunk_TA_bit9-carbonblack +suspicious_rundll32_plugininit,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +file_with_samsam_extension,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +silentcleanup_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +ntdsutil_export_ntds,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +disabling_systemrestore_in_registry,5.0.1,,Splunk_TA_bit9-carbonblack +vbscript_execution_using_wscript_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_spawning_control,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +start_up_during_safe_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_product_spawning_mshta,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_to_safe_mode_with_network_config,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +potentially_malicious_code_on_commandline,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_rundll32_application_control_bypass___advpack,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +services_escalate_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +wget_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_wmi_command_attempt,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +create_or_delete_windows_shares_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unload_sysmon_filter_driver,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +resize_shadowstorage_volume,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_indirect_command_execution_via_forfiles,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +wmic_xsl_execution_via_url,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_reg_exe_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +process_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +samsam_test_file_write,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +impacket_lateral_movement_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_process_with_namedpipe_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_comsvcs_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +creation_of_shadow_copy_with_wmic_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +overwriting_accessibility_binaries,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_schtasks_create_run_as_system,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +add_defaultuser_and_password_in_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +bits_job_persistence,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +any_powershell_downloadfile,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +w3wp_spawning_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_sharphound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_rclone_command_line_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_net_user_account,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +shim_database_installation_with_suspicious_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +dns_query_length_with_high_standard_deviation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" diff --git a/security_content_automation/detection_ta_mapping.yml b/security_content_automation/detection_ta_mapping.yml index ffb96a2eb7..712ebb520c 100644 --- a/security_content_automation/detection_ta_mapping.yml +++ b/security_content_automation/detection_ta_mapping.yml @@ -1,5 +1,5 @@ abnormally_high_number_of_cloud_infrastructure_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -17,7 +17,7 @@ abnormally_high_number_of_cloud_infrastructure_api_calls: - Splunk_TA_infoblox - Splunk_TA_salesforce abnormally_high_number_of_cloud_security_group_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -35,78 +35,73 @@ abnormally_high_number_of_cloud_security_group_api_calls: - Splunk_TA_infoblox - Splunk_TA_salesforce account_discovery_with_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon active_setup_registry_autostart: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon add_defaultuser_and_password_in_registry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon add_or_set_windows_defender_exclusion: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_file_and_printing_sharing_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_inbound_traffic_by_firewall_rule_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon allow_network_discovery_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_operation_with_consent_admin: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon anomalous_usage_of_7zip: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows any_powershell_downloadfile: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon any_powershell_downloadstring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attacker_tools_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -114,33 +109,34 @@ attacker_tools_on_endpoint: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows attempt_to_add_certificate_to_untrusted_store: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows attempt_to_stop_security_service: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attempted_credential_dump_from_registry_via_reg_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon auto_admin_logon_registry_entry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon batch_file_write_to_system32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -150,91 +146,92 @@ batch_file_write_to_system32: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bcdedit_command_back_to_normal_mode_boot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows bcdedit_failure_recovery_modification: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bits_job_persistence: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon bitsadmin_download_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_urlcache_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_verifyctl_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_exe_certificate_extraction: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_with_decode_argument: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon change_default_file_association: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon change_to_safe_mode_with_network_config: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows check_elevated_cmd_using_whoami: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows clear_unallocated_sector_using_cipher_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon clop_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cloud_api_calls_from_previously_unseen_user_roles: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -245,31 +242,19 @@ cloud_api_calls_from_previously_unseen_user_roles: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_compute_instance_created_by_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_compute_instance_created_in_previously_unused_region: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_image: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_instance_type: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_instance_modified_with_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -285,7 +270,7 @@ cloud_instance_modified_with_previously_unseen_user: - Splunk_TA_box - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_city: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -301,7 +286,7 @@ cloud_provisioning_from_previously_unseen_city: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_country: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -317,7 +302,7 @@ cloud_provisioning_from_previously_unseen_country: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_ip_address: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -331,7 +316,7 @@ cloud_provisioning_from_previously_unseen_ip_address: - Splunk_TA_box - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_region: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -347,90 +332,91 @@ cloud_provisioning_from_previously_unseen_region: - Splunk_TA_infoblox - Splunk_TA_salesforce cmd_echo_pipe___escalation: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cmdline_tool_not_executed_in_cmd_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon conti_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon control_loading_from_world_writable_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_local_admin_accounts_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_or_delete_windows_shares_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy_with_wmic_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_copy_command_from_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_symlink_to_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon curl_download_and_bash_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows deleting_of_net_users: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon deleting_shadow_copies: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_azurehound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_exchange_web_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -438,299 +424,222 @@ detect_exchange_web_shell: - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR detect_html_help_spawn_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_using_infotech_storage_handlers: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_path_interception_by_creation_of_program_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_processes_used_for_system_network_configuration_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_psexec_with_accepteula_flag: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rclone_command_line_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regasm_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_regasm_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvcs_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_regsvcs_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvr32_application_control_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___advpack: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___setupapi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___syssetup: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_sharphound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_sharphound_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_use_of_cmd_exe_to_launch_script_interpreters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows disable_amsi_through_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_defender_antivirus_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_mpengine_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_submit_samples_consent_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disable_etw_through_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disable_logs_using_wevtutil: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_registry_tool: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disable_schedule_task: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -disable_security_logs_using_minint_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disable_windows_app_hotkeys: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_windows_behavior_monitoring: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_cmd_application: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_controlpanel: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_defender_services: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon disabling_firewall_with_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_folderoptions_windows_feature: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_net_user_account: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_norun_windows_app: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_systemrestore_in_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_task_manager: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon dns_exfiltration_using_nslookup_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dns_query_length_with_high_standard_deviation: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -739,101 +648,88 @@ dns_query_length_with_high_standard_deviation: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_infoblox domain_account_discovery_with_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows domain_account_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows domain_controller_discovery_with_nltest: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dsquery_domain_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR dump_lsass_via_comsvcs_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dump_lsass_via_procdump: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR elevated_group_discovery_with_net: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon elevated_group_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon enable_rdp_in_other_port_number: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -etw_registry_disabled: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon eventvwr_uac_bypass: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon excel_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_attempt_to_disable_services: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -excessive_number_of_distinct_processes_created_in_windows_temp_folder: - cim_version: 5.0.0 +excessive_distinct_processes_from_windows_temp: + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: @@ -844,14 +740,15 @@ excessive_number_of_distinct_processes_created_in_windows_temp_folder: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm excessive_number_of_service_control_start_as_disabled: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows excessive_number_of_taskhost_processes: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: @@ -861,50 +758,50 @@ excessive_number_of_taskhost_processes: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_service_stop_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_cacls_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_usage_of_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_taskkill: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR executables_or_script_creation_in_suspicious_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR execute_javascript_with_jscript_com_clsid: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows execution_of_file_with_multiple_extensions: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -912,13 +809,13 @@ execution_of_file_with_multiple_extensions: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows extraction_of_registry_hives: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon file_with_samsam_extension: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -931,99 +828,106 @@ file_with_samsam_extension: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR firewall_allowed_program_enable: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows fodhelper_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows fsutil_zeroing_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_aduserresultantpasswordpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_domainpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_domaintrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon get_domainuser_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_foresttrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaincomputer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaingroup_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_computer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_group_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_user_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows hide_user_account_from_sign_in_screen: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon hiding_files_and_directories_with_attrib_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1031,29 +935,31 @@ hiding_files_and_directories_with_attrib_exe: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows icacls_deny_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR icacls_grant_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR impacket_lateral_movement_commandline_parameters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon java_class_file_download_by_java_user_agent: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_citrix-netscaler - Splunk_TA_nginx @@ -1064,309 +970,397 @@ java_class_file_download_by_java_user_agent: - Splunk_TA_mcafee-wg - Splunk_TA_cisco-wsa jscript_execution_using_cscript_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows linux_add_files_in_known_crontab_directories: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_at_allow_config_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_at_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_change_file_owner_to_root: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR +linux_dd_file_overwrite: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_deletion_of_cron_jobs: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_deletion_of_init_daemon_script: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_deletion_of_services: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_deletion_of_ssh_key: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_deletion_of_ssl_certificate: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon linux_doas_conf_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_doas_tool_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_file_created_in_kernel_driver_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_file_creation_in_init_boot_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_file_creation_in_profile_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_high_frequency_of_file_deletion_in_etc_folder: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_insert_kernel_module_using_insmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_install_kernel_module_using_modprobe_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_iptables_firewall_modification: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_java_spawning_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file: - cim_version: 5.0.0 +linux_kworker_process_commandline: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_nopasswd_entry_in_sudoers_file: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_pkexec_privilege_escalation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_possible_access_or_modification_of_sshd_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_credential_files: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_sudoers_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_at_allow_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_profile_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_ssh_key_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_preload_hijack_library_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_file_created_in_systemd_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_service_restarted: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_started_or_enabled: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_chmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_setcap_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_stdout_redirection_to_dev_null_file: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_sudoers_tmp_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +linux_system_network_discovery: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR linux_visudo_utility_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR logon_script_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon malicious_powershell_process___execution_policy_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon malicious_powershell_process_with_obfuscation_techniques: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows mmc_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon modify_acl_permission_to_files_or_folder: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR msbuild_suspicious_spawned_by_script_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon mshta_spawning_rundll32_or_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon msmpeng_application_dll_side_loading: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR net_profiler_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon nishang_powershelltcponeline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon nltest_domain_trust_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows ntdsutil_export_ntds: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows office_application_spawn_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_application_spawn_rundll32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_document_spawned_child_process_to_download: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawn_cmd_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_bitsadmin: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_certutil: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_mshta: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_rundll32_with_no_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_spawning_control: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon overwriting_accessibility_binaries: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1380,57 +1374,53 @@ overwriting_accessibility_binaries: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR permission_modification_using_takeown_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon ping_sleep_batch_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon possible_lateral_movement_powershell_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon potentially_malicious_code_on_commandline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows powershell_disable_security_monitoring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon powershell_start_bitstransfer: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon prevent_automatic_repair_mode_using_bcdedit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -print_processor_registry_autostart: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon process_creating_lnk_file_in_suspicious_location: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1438,156 +1428,164 @@ process_creating_lnk_file_in_suspicious_location: - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR process_execution_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR process_kill_base_on_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon processes_launching_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows recursive_delete_of_directory_in_batch_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon reg_exe_manipulating_windows_services_registry_keys: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR registry_keys_used_for_persistence: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon regsvr32_silent_and_install_param_dll_loading: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon regsvr32_with_known_silent_switch_cmdline: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_dcom_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_winrs: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_system_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_wmi_command_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows resize_shadowstorage_volume: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows revil_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon revil_registry_entry: - cim_version: 5.0.0 + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +rubeus_command_line_parameters: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows rundll32_control_rundll_world_writable_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_shimcache_flush: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_with_no_command_line_arguments_with_network: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +rundll_loading_dll_by_ordinal: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon ryuk_wake_on_lan_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows samsam_test_file_write: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1600,65 +1598,67 @@ samsam_test_file_write: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR sc_exe_manipulating_windows_services: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR scheduled_task_creation_on_remote_endpoint_using_at: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon scheduled_task_deleted_or_created_via_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows scheduled_task_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon schtasks_run_task_on_demand: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_scheduling_job_on_remote_system: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_used_for_forcing_a_reboot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR screensaver_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon script_execution_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1669,75 +1669,77 @@ script_execution_via_wmi: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm sdclt_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon sdelete_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon secretdumps_offline_ntds_dumping_tool: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon serviceprincipalnames_discovery_with_setspn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon services_escalate_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows services_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon set_default_powershell_execution_policy_to_unrestricted_or_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon shim_database_installation_with_suspicious_parameters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR short_lived_windows_accounts: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft-cloudservices - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose - Splunk_TA_cyberark silentcleanup_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon single_letter_process_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1748,27 +1750,29 @@ single_letter_process_on_endpoint: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm slui_runas_elevated: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows slui_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows spoolsv_spawning_rundll32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon spoolsv_writing_a_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1777,145 +1781,151 @@ spoolsv_writing_a_dll: - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR start_up_during_safe_mode_boot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon suspicious_copy_on_system32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_dllhost_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_gpupdate_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_icedid_rundll32_cmdline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +suspicious_linux_discovery_commands: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_microsoft_workflow_compiler_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -suspicious_msbuild_rename: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_mshta_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows suspicious_mshta_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_process_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows suspicious_reg_exe_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_regsvr32_register_suspicious_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_dllregisterserver: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_plugininit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_startw: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_with_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_scheduled_task_from_public_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows suspicious_searchprotocolhost_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_wevtutil_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR svchost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon system_information_discovery_detection: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1926,7 +1936,7 @@ system_information_discovery_detection: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm system_processes_run_from_unexpected_locations: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1934,217 +1944,311 @@ system_processes_run_from_unexpected_locations: - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR time_provider_persistence_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon unified_messaging_service_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows uninstall_app_using_msiexec: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows unload_sysmon_filter_driver: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR usn_journal_deletion: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows vbscript_execution_using_wscript_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon w3wp_spawning_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wbadmin_delete_system_backups: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR wermgr_process_spawned_cmd_or_powershell_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wget_download_and_bash_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows windows_adfind_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows windows_curl_download_to_suspicious_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_curl_upload_to_remote_destination: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon +windows_disable_change_password_through_registry: + cim_version: 5.0.1 tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_disableantispyware_reg: - cim_version: 5.0.0 + - Splunk_TA_bit9-carbonblack +windows_disable_lock_workstation_feature_through_registry: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +windows_disable_logoff_button_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_disable_memory_crash_dump: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_disable_shutdown_button_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_disable_windows_group_policy_features_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_disableantispyware_reg: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack windows_dism_remove_defender: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_dotnet_binary_in_non_standard_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_file_without_extension_in_critical_folder: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_hide_notification_features_through_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_indirect_command_execution_via_forfiles: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +windows_indirect_command_execution_via_pcalua: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows windows_installutil_credential_theft: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_in_non_standard_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_uninstall_option: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_modify_show_compress_color_and_info_tip_registry: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon windows_nirsoft_advancedrun: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_process_with_namedpipe_commandline: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_raccine_scheduled_task_deletion: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_remote_assistance_spawning_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_schtasks_create_run_as_system: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +windows_service_creation_using_registry_entry: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack windows_service_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winhlp32_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmic_xsl_execution_via_url: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmiprsve_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wscript_or_cscript_suspicious_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsmprovhost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsreset_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon xsl_script_execution_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows