From 7194ba1867f42e191499994a291d83dca048fa36 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 29 Jun 2021 15:36:04 -0500 Subject: [PATCH] adding empty keys to the ymls --- ...mber_of_cloud_infrastructure_api_calls.yml | 22 +++++++++- ...mber_of_cloud_security_group_api_calls.yml | 40 +++++++++++++++++++ ..._policy_version_to_allow_all_resources.yml | 22 +++++++++- detections/cloud/aws_createaccesskey.yml | 22 +++++++++- detections/cloud/aws_createloginprofile.yml | 22 +++++++++- ...ctivity_from_previously_unseen_account.yml | 22 +++++++++- ...g_keys_with_encrypt_policy_without_mfa.yml | 22 +++++++++- ...with_kms_keys_performing_encryption_s3.yml | 20 ++++++++++ .../cloud/aws_excessive_security_scanning.yml | 22 +++++++++- .../aws_iam_accessdenied_discovery_events.yml | 22 +++++++++- ...aws_iam_assume_role_policy_brute_force.yml | 22 +++++++++- detections/cloud/aws_iam_delete_policy.yml | 22 +++++++++- .../cloud/aws_iam_failure_group_deletion.yml | 22 +++++++++- .../aws_iam_successful_group_deletion.yml | 22 +++++++++- ...ntrol_list_created_with_all_open_ports.yml | 20 ++++++++++ ...ws_network_access_control_list_deleted.yml | 20 ++++++++++ ..._access_by_provider_user_and_principal.yml | 20 ++++++++++ .../aws_saml_update_identity_provider.yml | 22 +++++++++- .../cloud/aws_setdefaultpolicyversion.yml | 22 +++++++++- detections/cloud/aws_updateloginprofile.yml | 22 +++++++++- ...alls_from_previously_unseen_user_roles.yml | 20 ++++++++++ ...ance_created_by_previously_unseen_user.yml | 22 +++++++++- ...ce_created_in_previously_unused_region.yml | 22 +++++++++- ...e_created_with_previously_unseen_image.yml | 22 +++++++++- ...d_with_previously_unseen_instance_type.yml | 22 +++++++++- ...e_modified_with_previously_unseen_user.yml | 20 ++++++++++ ...ovisioning_from_previously_unseen_city.yml | 20 ++++++++++ ...sioning_from_previously_unseen_country.yml | 20 ++++++++++ ...ning_from_previously_unseen_ip_address.yml | 20 ++++++++++ ...isioning_from_previously_unseen_region.yml | 20 ++++++++++ .../detect_aws_console_login_by_new_user.yml | 20 ++++++++++ ...ws_console_login_by_user_from_new_city.yml | 20 ++++++++++ ...console_login_by_user_from_new_country.yml | 20 ++++++++++ ..._console_login_by_user_from_new_region.yml | 20 ++++++++++ .../cloud/detect_new_open_s3_buckets.yml | 22 +++++++++- ...etect_new_open_s3_buckets_over_aws_cli.yml | 22 +++++++++- ...s_security_hub_alerts_for_ec2_instance.yml | 22 +++++++++- ...365_add_app_role_assignment_grant_user.yml | 22 +++++++++- .../cloud/o365_added_service_principal.yml | 22 +++++++++- .../cloud/o365_bypass_mfa_via_trusted_ip.yml | 22 +++++++++- detections/cloud/o365_disable_mfa.yml | 22 +++++++++- ...xcessive_authentication_failures_alert.yml | 22 +++++++++- .../cloud/o365_excessive_sso_logon_errors.yml | 22 +++++++++- .../cloud/o365_new_federated_domain_added.yml | 22 +++++++++- detections/cloud/o365_pst_export_alert.yml | 22 +++++++++- ...o365_suspicious_admin_email_forwarding.yml | 22 +++++++++- .../o365_suspicious_rights_delegation.yml | 22 +++++++++- .../o365_suspicious_user_email_forwarding.yml | 22 +++++++++- 48 files changed, 1013 insertions(+), 33 deletions(-) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 5e658d3da2..dc127fd147 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -55,7 +55,27 @@ tags: impact: 30 confidence: 50 # (impact * confidence)/100 - risk_score: 15 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + context: - Source:Cloud Data - Stage:Recon diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 4aa1e3f506..9861954acb 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -56,4 +56,44 @@ tags: risk_object: user risk_object_type: user risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 046e58d6bf..292167be21 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -54,5 +54,25 @@ tags: - requestParameters.userName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 9b287b1b03..015b802e56 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -51,5 +51,25 @@ tags: - requestParameters.userName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index ab5045322f..617fd8ec62 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -53,5 +53,25 @@ tags: - requestParameters.userName risk_object: src_ip risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index c665a5fac0..541aa0b938 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -59,5 +59,25 @@ tags: - Authentication.src risk_object: user risk_object_type: user - risk_score: 15 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index 1317a589e7..a278678cde 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -49,5 +49,25 @@ tags: - userIdentity.principalId risk_object: userIdentity.principalId risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 90ba2951eb..7ef6b0ee15 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -46,4 +46,24 @@ tags: risk_object: user risk_object_type: user risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 1a9ccb38e5..d793b45770 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -49,5 +49,25 @@ tags: - userIdentity.arn risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index ef96015f78..a784b77558 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -46,5 +46,25 @@ tags: - userIdentity.type risk_object: src_ip risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: access diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 8dbe65bb13..d60a96d74c 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -51,5 +51,25 @@ tags: - requestParameters.policyName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: access diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index b049e0f898..9f7b2e6cf7 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -48,5 +48,25 @@ tags: - requestParameters.policyArn risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: access diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 0315b7eb6b..427d879dae 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -48,5 +48,25 @@ tags: - requestParameters.groupName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: identity diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 997d2d01d5..9198760fe9 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -47,5 +47,25 @@ tags: - requestParameters.groupName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: identity diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index f2969bf48a..e611087046 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -60,4 +60,24 @@ tags: risk_object: userName risk_object_type: user risk_score: 10 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index c9eb4fcbbc..415285df00 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -52,4 +52,24 @@ tags: risk_object: userName risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index a9805a8494..9eb4750175 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -54,4 +54,24 @@ tags: risk_object: recipientAccountId risk_object_type: other risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index b612fb0986..280de956db 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -48,5 +48,25 @@ tags: - userIdentity.principalId risk_object: sourceIPAddress risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 81f4fe04a5..503c5b8a53 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -54,5 +54,25 @@ tags: - eventSource risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 48ce03108b..c9e4155520 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -51,5 +51,25 @@ tags: - requestParameters.userName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 6e4aee9e77..658c5774b9 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -54,4 +54,24 @@ tags: risk_object: user risk_object_type: user risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 6d8f20e18d..b445805ad4 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -50,5 +50,25 @@ tags: - All_Changes.vendor_region risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 5181900d57..8324c4f333 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -56,5 +56,25 @@ tags: - All_Changes.user risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 068b7651d9..596456d7c6 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -51,5 +51,25 @@ tags: - All_Changes.user risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 30e8096950..af03cd265d 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -51,5 +51,25 @@ tags: - All_Changes.user risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 810320d61c..dbdc5ed8fb 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -54,4 +54,24 @@ tags: risk_object: user risk_object_type: user risk_score: 10 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index aa1b0b25d6..9d1da09d24 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -69,4 +69,24 @@ tags: risk_object: user risk_object_type: user risk_score: 10 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index daa8caf0d3..5fe069b61d 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -69,4 +69,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index b96889ae17..6731c029ee 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -68,4 +68,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 41446e109c..b5e9badf96 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -69,4 +69,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: endpoint diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 22b17e8a28..12e2d8945c 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -55,4 +55,24 @@ tags: risk_object: user risk_object_type: user risk_score: 30 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index bb25888484..b2d288f7d0 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -64,4 +64,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index fd6b5eb1b2..aa1f6c0e2e 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -64,4 +64,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index a87c40ec8d..4239656733 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -64,4 +64,24 @@ tags: risk_object: user risk_object_type: user risk_score: 5 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index acf9405483..f43458e83d 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -56,5 +56,25 @@ tags: - permission risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index db34ceed1f..c31dfaf0a6 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -60,5 +60,25 @@ tags: - bucketName risk_object: src risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 7af9fabe30..29ee75cd28 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -48,5 +48,25 @@ tags: - dest risk_object: dest risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: network diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index efc41e965e..030b2601d4 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -48,5 +48,25 @@ tags: - ResultStatus risk_object: dest risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 0fe3f211bc..bacaadac86 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -51,5 +51,25 @@ tags: - ActorIpAddress risk_object: ActorIpAddress risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index bb5677d7e1..3696111a1b 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -54,5 +54,25 @@ tags: - action risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index a219fe3e1f..15db9bf6ea 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -44,5 +44,25 @@ tags: - ResultStatus risk_object: dest risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 8733d5e50f..ac547fefdc 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -44,5 +44,25 @@ tags: - user risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 5dba881c26..4126247f9f 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -44,5 +44,25 @@ tags: - UserId risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 6a6b4e0d8b..c3f08359bf 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -51,5 +51,25 @@ tags: - UserKey risk_object: UserId risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 1f260b8963..4fc6516f4b 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -45,5 +45,25 @@ tags: - Operation risk_object: Source risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 9a5d5b3ea6..93f9962a95 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -44,5 +44,25 @@ tags: - Parameters risk_object: src_user risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 78cd3628d2..ab80945b93 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -43,5 +43,25 @@ tags: - Parameters risk_object: user risk_object_type: user - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 698a76fd93..897d83d573 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -44,5 +44,25 @@ tags: - Parameters risk_object: ForwardingSmtpAddress risk_object_type: system - risk_score: 20 + risk_score: 25 + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + - Source: Cloud Data + - Scope: Internal, External, Inbound, Outbound, Local, Network + - Outcome: Blocked, Allowed + - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control + - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location + - Other: Policy Violation + + message: + observable: + - name: + type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location + + role: + - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss + security_domain: threat