admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ssa_WIP_misko_stat_detections' of github.com:splunk/security-content into ssa_WIP_misko_stat_detections

Browse Source
This commit is contained in:
Stanislav Miskovic
2021-09-09 20:33:50 -07:00
parent 52b2b3ddfd 450961c09b
commit 7a97b00762
114 changed files with 97890 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+19 -1
View File
@@ -147,21 +147,26 @@ jobs:
source venv/bin/activate
python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
#make a copy of use_case_lib in order to have ES work :-(
cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
- name: Copy lookups .csv files
run: |
# clean up current lookups
rm -rf dist/escu/lookups
rm -rf dist/saaws/lookups
rm -rf dist/devsecops/lookups
mkdir dist/escu/lookups
mkdir dist/saaws/lookups
mkdir dist/devsecops/lookups
#copy over lookups
cd lookups
cp -rv *.csv ../dist/escu/lookups
cp -rv *.csv ../dist/saaws/lookups
cp -rv *.csv ../dist/devsecops/lookups
#Tag is '' for non-tagged push and the tag name for a tagged release
- name: Set tag
@@ -191,13 +196,17 @@ jobs:
sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
tar -czf content-pack-build-escu.tar.gz dist/escu/*
# update build number and version for saaws
sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf
sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/saaws/app.manifest
sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/content-version.conf
tar -czf content-pack-build-saaws.tar.gz dist/saaws/*
# update build number and version for devsecops
tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/*
- name: Persist to Workspace
uses: actions/upload-artifact@v2
with:
@@ -205,6 +214,7 @@ jobs:
path: |
content-pack-build-escu.tar.gz
content-pack-build-saaws.tar.gz
content-pack-build-devsecops.tar.gz
build-package:
@@ -248,10 +258,13 @@ jobs:
cd build
tar -zxf content-pack-build-escu.tar.gz
tar -zxf content-pack-build-saaws.tar.gz
tar -zxf content-pack-build-devsecops.tar.gz
mv dist/escu DA-ESS-ContentUpdate
mv dist/saaws DA-ESS_AmazonWebServices_Content
mv dist/devsecops dev_sec_ops_analytics
slim package -o upload DA-ESS-ContentUpdate
slim package -o upload DA-ESS_AmazonWebServices_Content
slim package -o upload dev_sec_ops_analytics
cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
@@ -259,6 +272,10 @@ jobs:
cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz
sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt
cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
touch tag-canary.txt
- name: store_artifacts
uses: actions/upload-artifact@v2
with:
@@ -272,6 +289,7 @@ jobs:
path: |
build/DA-ESS-ContentUpdate-latest.tar.gz
build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
build/dev_sec_ops_analytics-latest.tar.gz
build/checksum.txt
.github/workflows/detection-testing.yml
+10 -1
View File
@@ -28,11 +28,20 @@ jobs:
echo "PASS: Not a tagged release"
exit 0
fi
quit-for-dependabot:
runs-on: ubuntu-latest
if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
steps:
- name: "Placeholder"
run: |
echo "yes it ran"
detection-testing:
runs-on: ubuntu-latest
environment: Detection-Testing-Approval
needs: [validate-tag-if-present]
needs: [validate-tag-if-present, quit-for-dependabot]
steps:
- name: Checkout Repo
automated_detection_testing/requirements.txt
+1 -1
View File
@@ -6,7 +6,7 @@ atomicwrites==1.4.0
attackcti==0.3.4.3
attrs==21.2.0
azure-common==1.1.27
azure-core==1.16.0
azure-core==1.18.0
azure-identity==1.6.0
azure-mgmt-compute==20.0.0
azure-mgmt-core==1.2.1
bin/generate.py
+23 -1
View File
@@ -17,6 +17,10 @@ import csv
import shutil
# Global variable
global_product = 'ESCU'
def load_objects(file_path, VERBOSE, REPO_PATH):
files = []
manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
@@ -393,6 +397,18 @@ def add_rba(detection):
def prepare_detections(detections, deployments, OUTPUT_PATH):
for detection in detections:
# only for DevSecOps
if global_product == 'DevSecOps':
if detection['tags']['risk_score']:
detection['search'] = detection['search'] + ' | eval risk_score=' + str(detection['tags']['risk_score'])
if detection['type'] == 'Anomaly':
detection['search'] = detection['search'] + ' | collect index=signals'
elif detection['type'] == 'TTP':
detection['search'] = detection['search'] + ' | collect index=alerts'
elif detection['type'] == 'Correlation':
detection['search'] = detection['search'] + ' | collect index=alerts'
# parse out data_models
data_model = parse_data_models_from_search(detection['search'])
if data_model:
@@ -571,6 +587,11 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
objects["detections"] = [object for object in objects["detections"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
if PRODUCT == "DevSecOps":
objects["detections"] = [object for object in objects["detections"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
objects["stories"] = [object for object in objects["stories"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
# only use ESCU detections to the configurations
objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
# only use ESCU stories to the configuration
@@ -589,7 +610,8 @@ def get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
return objects
def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
global global_product
global_product = PRODUCT
TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
detections/cloud/aws_ecr_container_scanning_findings_high.yml
+10 -8
View File
@@ -12,10 +12,11 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=HIGH | rename name as finding_name,
description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
requestParameters.repositoryName as image | eval finding = finding_name.",
".finding_description | eval phase="release" | eval severity="high"
| stats min(_time) as firstTime max(_time) as lastTime by
awsRegion, eventName, eventSource, imageDigest, image, user, userName,
src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_high_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
@@ -28,11 +29,11 @@ tags:
asset_type: AWS Account
cis20:
- CIS 13
confidence: 70
confidence: 100
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Vulnerabilities with severity high found in repository $repositoryName$
message: Vulnerabilities with severity high found in image $image$
mitre_attack_id:
- T1204.003
nist:
@@ -40,7 +41,7 @@ tags:
- PR.AC
- DE.CM
observable:
- name: repositoryName
- name: image
type: System
role:
- Victim
@@ -48,6 +49,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
@@ -58,5 +60,5 @@ tags:
- user
- userName
- src_ip
risk_score: 49
risk_score: 70
security_domain: network
detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+5 -4
View File
@@ -13,9 +13,9 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
= finding_name.", ".finding_description | stats min(_time) as firstTime max(_time)
= finding_name.", ".finding_description | eval phase="release" | eval severity="low" | stats min(_time) as firstTime max(_time)
as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user,
userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
@@ -29,7 +29,7 @@ tags:
cis20:
- CIS 13
confidence: 70
impact: 70
impact: 10
kill_chain_phases:
- Actions on Objectives
message: Vulnerabilities with severity high found in repository $repositoryName$
@@ -48,6 +48,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
@@ -58,5 +59,5 @@ tags:
- user
- userName
- src_ip
risk_score: 49
risk_score: 7
security_domain: network
detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+10 -8
View File
@@ -12,10 +12,11 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
requestParameters.repositoryName as image | eval finding = finding_name.",
".finding_description | eval phase="release" | eval severity="medium"
| stats min(_time) as firstTime max(_time) as lastTime by
awsRegion, eventName, eventSource, imageDigest, image, user, userName,
src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_medium_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
@@ -29,10 +30,10 @@ tags:
cis20:
- CIS 13
confidence: 70
impact: 70
impact: 30
kill_chain_phases:
- Actions on Objectives
message: Vulnerabilities with severity high found in repository $repositoryName$
message: Vulnerabilities with severity high found in image $image$
mitre_attack_id:
- T1204.003
nist:
@@ -40,7 +41,7 @@ tags:
- PR.AC
- DE.CM
observable:
- name: repositoryName
- name: image
type: System
role:
- Victim
@@ -48,6 +49,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
@@ -58,5 +60,5 @@ tags:
- user
- userName
- src_ip
risk_score: 49
risk_score: 21
security_domain: network
detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+4 -2
View File
@@ -10,8 +10,9 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
When done outside business hours, we want to take a look into it.
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.*
as * | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, user, userName, src_ip, imageTag, registryId, repositoryName | `security_content_ctime(firstTime)`
as * | rename repositoryName AS image | eval phase="release" | eval severity="medium"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
@@ -49,6 +50,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
detections/cloud/aws_ecr_container_upload_unknown_user.yml
+4 -2
View File
@@ -10,9 +10,10 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
users. When the user was never seen before, we should have a closer look into the
event.
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
| rename requestParameters.* as * | stats min(_time) as firstTime max(_time) as
| rename requestParameters.* as * | rename repositoryName AS image | eval phase="release"
| eval severity="high" | stats min(_time) as firstTime max(_time) as
lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag,
registryId, repositoryName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
registryId, image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_upload_unknown_user_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
@@ -49,6 +50,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
detections/cloud/aws_excessive_security_scanning.yml
+1
View File
@@ -58,6 +58,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
- eventName
detections/cloud/circle_ci_disable_security_job.yml
+3 -2
View File
@@ -7,11 +7,12 @@ type: Anomaly
datamodel: []
description: This search looks for disable security job in CircleCI pipeline.
search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval
mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
mandatory_job_executed=0 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
mandatory_job_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `circle_ci_disable_security_job_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
detections/cloud/circle_ci_disable_security_step.yml
+2 -1
View File
@@ -11,7 +11,8 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
* , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | `security_content_ctime(firstTime)`
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0
| rex field=url "(?<repository>[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
detections/cloud/correlation_by_repository_and_risk.yml
+46
View File
@@ -0,0 +1,46 @@
name: Correlation by Repository and Risk
id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
version: 1
date: '2021-09-06'
author: Patrick Bareiss, Splunk
type: Correlation
datamodel: []
description: This search correlations detections by repository and risk_score
search: '`signals` | fillnull
| stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository
| sort - risk_score | where risk_score > 80
| `correlation_by_repository_and_risk_filter`'
how_to_implement: For Dev Sec Ops POC
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
asset_type: AWS Account
cis20:
- CIS 13
confidence: 100
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Correlation triggered for user $user$
mitre_attack_id:
- T1204.003
nist:
- PR.DS
- PR.AC
- DE.CM
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 70
security_domain: network
detections/cloud/correlation_by_user_and_risk.yml
+46
View File
@@ -0,0 +1,46 @@
name: Correlation by User and Risk
id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
version: 1
date: '2021-09-06'
author: Patrick Bareiss, Splunk
type: Correlation
datamodel: []
description: This search correlations detections by user and risk_score
search: '`signals` | fillnull
| stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user
| sort - risk_score | where risk_score > 80
| `correlation_by_user_and_risk_filter`'
how_to_implement: For Dev Sec Ops POC
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
asset_type: AWS Account
cis20:
- CIS 13
confidence: 100
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Correlation triggered for user $user$
mitre_attack_id:
- T1204.003
nist:
- PR.DS
- PR.AC
- DE.CM
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 70
security_domain: network
detections/cloud/github_commit_changes_in_master.yml
+3 -2
View File
@@ -10,9 +10,9 @@ description: This search is to detect a pushed or commit to master or main branc
Ideally in terms of devsecops the changes made in a branch and do a PR for review.
of course in some cases admin of the project may did a changes directly to master
branch
search: '`github` branches{}.name = main OR branches{}.name = master | stats count
search: '`github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" | stats count
min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email
commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to github logs having the fork, commit, push metadata that can be use
@@ -45,6 +45,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 9
detections/cloud/github_commit_in_develop.yml
+1
View File
@@ -43,6 +43,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 9
detections/cloud/github_dependabot_alert.yml
+2 -2
View File
@@ -7,10 +7,10 @@ type: Anomaly
datamodel: []
description: This search looks for Dependabot Alerts in Github logs.
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time)
as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
alert.external_identifier alert.external_reference alert.fixed_in alert.severity
repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
repository repository_url user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_dependabot_alert_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
detections/cloud/github_pull_request_from_unknown_user.yml
+4 -3
View File
@@ -7,11 +7,12 @@ type: Anomaly
datamodel: []
description: This search looks for Pull Request from unknown user.
search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
repository.full_name check_suite.pull_requests{}.head.ref
check_suite.head_commit.message | rename check_suite.head_commit.author.name as
user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
user repository.full_name as repository check_suite.pull_requests{}.head.ref
as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_pull_request_from_unknown_user_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown
detections/cloud/gsuite_drive_share_in_external_email.yml
+3 -2
View File
@@ -10,10 +10,10 @@ description: This search is to detect suspicious google drive or google docs fil
exfitration of data made by an attacker or insider to a targetted machine.
search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"
| rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com"
and not dest_domain = "internal_test_email.com" | stats values(parameters.doc_title)
and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(parameters.doc_title)
as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list,
values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time)
as lastTime by parameters.owner | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
as lastTime by parameters.owner phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_drive_share_in_external_email_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
@@ -50,6 +50,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
- parameters.doc_title
detections/cloud/gsuite_email_suspicious_attachment.yml
+3 -1
View File
@@ -12,10 +12,11 @@ description: This search is to detect a suspicious attachment file extension in
file type that maybe send by employee or network admin.
search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh",
"bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
| eval phase="plan" | eval severity="medium"
| stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)
as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)
as payload_size by destination{}.service num_message_attachments subject destination{}.address
source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_email_suspicious_attachment_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
@@ -53,6 +54,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
- attachment{}.file_extension_type
detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+10 -12
View File
@@ -19,11 +19,11 @@ search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups
IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
"[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime
max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments,
values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
by destination{}.service num_message_attachments subject destination{}.address
source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_email_suspicious_subject_with_attachment_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
@@ -49,20 +49,18 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1566.001
observable:
- name: source.address
type: User
role:
- attacker
- name: destination{}.address
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 25
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- Source:Endpoint
- Stage:Reconnaissance
message: suspicious email from $source.address$ to $destination{}.address$
detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+10 -12
View File
@@ -12,9 +12,9 @@ description: This analytics is to detect a gmail containing a link that are know
search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
"[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains
and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" |stats values(link_domain{}) as link_domains
min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address
subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
subject destination{}.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_email_with_known_abuse_web_service_link_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
@@ -39,20 +39,18 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1566.001
observable:
- name: source.address
type: User
role:
- attacker
- name: destination{}.address
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 25
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- Source:Endpoint
- Stage:Reconnaissance
message: suspicious email from $source.address$ to $destination{}.address$
detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
+3 -1
View File
@@ -12,9 +12,10 @@ description: This search is to detect a suspicious outbound e-mail from internal
search: '`gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address
"[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
| where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com"
| eval phase="plan" | eval severity="low"
| stats values(subject) as subject, values(source.from_header_address) as src_domain_list,
count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time)
as firstTime max(_time) as lastTime by dest_domain | where numSrcAddresses < 20
as firstTime max(_time) as lastTime by dest_domain phase severity | where numSrcAddresses < 20
|sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_outbound_email_with_attachment_to_external_domain_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -53,6 +54,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
risk_score: 9
detections/cloud/gsuite_suspicious_shared_file_name.yml
+3 -2
View File
@@ -17,9 +17,9 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
"*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet",
"presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex
field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats count min(_time) as firstTime
max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title
parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
parameters.doc_type phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_suspicious_shared_file_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
@@ -58,6 +58,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
- parameters.doc_title
detections/cloud/kubernetes_nginx_ingress_lfi.yml
+3 -1
View File
@@ -11,8 +11,9 @@ search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+
| lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT
lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as
status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s"
| eval phase="operate" | eval severity="high"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status,
url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
@@ -48,6 +49,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- raw
risk_score: 49
detections/cloud/kubernetes_nginx_ingress_rfi.yml
+3 -2
View File
@@ -10,8 +10,8 @@ description: This search uses the Kubernetes logs from a nginx ingress controlle
search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)"
| rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name
as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip,
dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip,
dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
@@ -47,6 +47,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- raw
risk_score: 49
detections/cloud/kubernetes_scanner_image_pulling.yml
+6 -4
View File
@@ -10,8 +10,9 @@ description: This search uses the Kubernetes logs from Splunk Connect from Kuber
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
| eval phase="operate" | eval severity="high"
| stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace,
kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
kind, reason, message, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `kubernetes_scanner_image_pulling_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
@@ -24,10 +25,10 @@ tags:
automated_detection_testing: passed
cis20:
- CIS 13
confidence: 70
confidence: 90
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
impact: 70
impact: 90
kill_chain_phases:
- Actions on Objectives
message: Kubernetes Scanner image pulled on host $host$
@@ -44,6 +45,7 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- object.message
- source.host
@@ -52,5 +54,5 @@ tags:
- object.involvedObject.kind
- object.message
- object.reason
risk_score: 49
risk_score: 81
security_domain: network
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+61
View File
@@ -0,0 +1,61 @@
name: Add DefaultUser And Password In Registry
id: d4a3eb62-0f1e-11ec-a971-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: this search is to detect a suspicious registry modification to implement
auto admin logon to a host. This technique was seen in BlackMatter ransomware to
automatically logon to the compromise host after triggering a safemode boot to
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR
Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1552.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- Source:Endpoint
- Stage:Credential Access
message: modified registry key $registry_key_name$ with registry value $registry_value_name$
to prepare autoadminlogon
observable:
- name: dest
type: Endpoint
role:
- Victim
automated_detection_testing: passed
detections/endpoint/auto_admin_logon_registry_entry.yml
+61
View File
@@ -0,0 +1,61 @@
name: Auto Admin Logon Registry Entry
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: this search is to detect a suspicious registry modification to implement
auto admin logon to a host. This technique was seen in BlackMatter ransomware to
automatically logon to the compromise host after triggering a safemode boot to
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND
Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1552.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
security_domain: endpoint
impact: 70
confidence: 90
risk_score: 63
context:
- Source:Endpoint
- Stage:Credential Access
message: modified registry key $registry_key_name$ with registry value $registry_value_name$
to prepare autoadminlogon
observable:
- name: dest
type: Endpoint
role:
- Victim
automated_detection_testing: passed
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+67
View File
@@ -0,0 +1,67 @@
name: Bcdedit Command Back To Normal Mode Boot
id: dc7a8004-0f18-11ec-8c54-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious bcdedit commandline to configure
the host from safe mode back to normal boot configuration. This technique was seen
in blackMatter ransomware where it force the compromised host to boot in safe mode
to continue its encryption and bring back to normal boot using bcdedit deletevalue
command. This TTP can be a good alert for host that booted from safe mode forcefully
since it need to modify the boot configuration to bring it back to normal.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*"
by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1490
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.process_name
- Processes.process
- Processes.parent_process_name
- Processes.parent_process
- Processes.dest
- Processes.user
security_domain: endpoint
impact: 50
confidence: 70
risk_score: 35
context:
- Source:Endpoint
- Stage:Impact
message: bcdedit process with commandline $process$ to bring back to normal boot
configuration the $dest$
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
automated_detection_testing: passed
detections/endpoint/change_to_safe_mode_with_network_config.yml
+66
View File
@@ -0,0 +1,66 @@
name: Change To Safe Mode With Network Config
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious bcdedit commandline to configure
the host to boot in safe mode with network config. This technique was seen in blackMatter
ransomware where it force the compromised host to boot in safe mode to continue
its encryption and bring back to normal boot using bcdedit deletevalue command.
This TTP can be a good alert for host that booted from safe mode forcefully since
it need to modify the boot configuration to bring it back to normal.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*"
Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1490
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.process_name
- Processes.process
- Processes.parent_process_name
- Processes.parent_process
- Processes.dest
- Processes.user
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- Source:Endpoint
- Stage:Impact
message: bcdedit process with commandline $process$ to force safemode boot the $dest$
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
automated_detection_testing: passed
detections/endpoint/control_loading_from_world_writable_directory.yml
+85
View File
@@ -0,0 +1,85 @@
name: Control Loading from World Writable Directory
id: 10423ac4-10c9-11ec-8dc4-acde48001122
version: 1
date: '2021-09-08'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following detection identifies control.exe loading either a .cpl
or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
review parallel processes, parent and child, for further suspicious behaviors. In
addition, capture file modifications and analyze.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe
OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*",
"*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present as control.exe does
not natively load from writable paths as defined. One may add .cpl or .inf to the
command-line if there is any false positives. Tune as needed.
references:
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
tags:
analytic_story:
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+8 -7
View File
@@ -1,7 +1,7 @@
name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 5
date: '2021-08-29'
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
@@ -9,11 +9,12 @@ datamodel:
description: This search looks for the creation of local administrator accounts using
net.exe .
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`create_local_admin_accounts_using_net_exe_filter` '
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*) by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+8 -6
View File
@@ -8,12 +8,14 @@ datamodel:
- Endpoint
description: This search looks for the creation or deletion of hidden shares using
net.exe.
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe)
AND (Processes.process="* share *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `create_or_delete_windows_shares_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
detections/endpoint/extract_sam_from_registry.yml → detections/endpoint/extraction_of_registry_hives.yml
+6 -6
View File
@@ -1,7 +1,7 @@
name: Extract SAM from Registry
name: Extraction of Registry Hives
id: 8bbb7d58-b360-11eb-ba21-acde48001122
version: 1
date: '2021-05-12'
version: 2
date: '2021-09-09'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -12,11 +12,11 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
a untrusted process or script. Upon execution, a file will be written to disk.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam
*" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
detections/endpoint/known_services_killed_by_ransomware.yml
+5 -3
View File
@@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil
the targetted files it wants to encrypts because of the open handle of those services
to the targetted file.
search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
"*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
"*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `known_services_killed_by_ransomware_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
@@ -26,6 +27,7 @@ references:
tags:
analytic_story:
- Ransomware
- BlackMatter Ransomware
automated_detection_testing: passed
confidence: 80
context:
detections/endpoint/modification_of_wallpaper.yml
+1
View File
@@ -27,6 +27,7 @@ tags:
analytic_story:
- Ransomware
- Revil Ransomware
- BlackMatter Ransomware
automated_detection_testing: passed
confidence: 90
context:
detections/endpoint/mshtml_module_load_in_office_product.yml
+70
View File
@@ -0,0 +1,70 @@
name: MSHTML Module Load in Office Product
id: 5f1c168e-118b-11ec-84ff-acde48001122
version: 1
date: '2021-09-09'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following detection identifies the module load of mshtml.dll into
an Office product. This behavior has been related to CVE-2021-40444, whereas the
malicious document will load ActiveX, which activates the MSHTML component. The
vulnerability resides in the MSHTML component. During triage, identify parallel
processes and capture any file modifications for analysis.
search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process names and image loads from your endpoints. If you are using
Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Limited false positives will be present, however, tune as necessary.
references:
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://strontic.github.io/xcyclopedia/index-dll
tags:
analytic_story:
- Spearphishing Attachments
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1566.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- ImageLoaded
- process_name
- OriginalFileName
- process_id
- dest
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $process_name$ was identified on endpoint $dest$ loading
mshtml.dll.
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
detections/endpoint/office_spawning_control.yml
+83
View File
@@ -0,0 +1,83 @@
name: Office Spawning Control
id: 053e027c-10c7-11ec-8437-acde48001122
version: 1
date: '2021-09-08'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following detection identifies control.exe spawning from an office
product. This detection identifies any Windows Office Product spawning `control.exe`.
In malicious instances, the command-line of `control.exe` will contain a file path
to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection
down to the Office suite as a parent process. During triage, review all file modifications.
Capture and analyze any artifacts on disk. review parallel and child processes to
identify further suspicious behavior
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") Processes.process_name=control.exe
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives should be present.
references:
- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://www.echotrail.io/insights/search/control.exe
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
tags:
analytic_story:
- Spearphishing Attachments
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1566.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ clicking a suspicious attachment.
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
detections/endpoint/ransomware_notes_bulk_creation.yml
+1
View File
@@ -28,6 +28,7 @@ tags:
analytic_story:
- Clop Ransomware
- DarkSide Ransomware
- BlackMatter Ransomware
automated_detection_testing: passed
confidence: 90
context:
detections/endpoint/registry_keys_used_for_persistence.yml
+19 -11
View File
@@ -1,8 +1,8 @@
name: Registry Keys Used For Persistence
id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
version: 5
date: '2020-11-27'
author: David Dorsey, Splunk
version: 6
date: '2021-09-07'
author: Jose Hernandez, David Dorsey, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,14 +10,22 @@ description: The search looks for modifications to registry keys that can be use
to launch an application or service at system startup.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run*
OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell*
OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet*
OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices*
OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows
NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*)
by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`'
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows
NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger)
OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security
Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows
NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows"
AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user |
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `registry_keys_used_for_persistence_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
detections/endpoint/rundll32_control_rundll_hunt.yml
+88
View File
@@ -0,0 +1,88 @@
name: Rundll32 Control RunDLL Hunt
id: c8e7ced0-10c5-11ec-8b03-acde48001122
version: 1
date: '2021-09-08'
author: Michael Haag, Splunk
type: Hunting
datamodel:
- Endpoint
description: The following hunting detection identifies rundll32.exe with `control_rundll`
within the command-line, loading a .cpl or another file type. Developed in relation
to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files
(.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.
Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written
to be a bit more broad by not including .cpl. \ During triage, review parallel processes
to identify any further suspicious behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL* by
Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `rundll32_control_rundll_hunt_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: This is a hunting detection, meant to provide a understanding
of how voluminous control_rundll is within the environment.
references:
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
tags:
analytic_story:
- Suspicious Rundll32 Activity
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.011
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 30
confidence: 50
risk_score: 15
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+90
View File
@@ -0,0 +1,90 @@
name: Rundll32 Control RunDLL World Writable Directory
id: 1adffe86-10c3-11ec-8ce6-acde48001122
version: 1
date: '2021-09-08'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following detection identifies rundll32.exe with `control_rundll`
within the command-line, loading a .cpl or another file type from windows\temp,
programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can
also be used to execute Control Panel Item files (.cpl) through the undocumented
shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a
.cpl file also causes rundll32.exe to execute. This is written to be a bit more
broad by not including .cpl. The paths are specified, add more as needed. During
triage, review parallel processes to identify any further suspicious behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*
AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by
Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `rundll32_control_rundll_world_writable_directory_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: This may be tuned, or a new one related, by adding .cpl to
command-line. However, it's important to look for both. Tune/filter as needed.
references:
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
tags:
analytic_story:
- Suspicious Rundll32 Activity
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.011
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+66
View File
@@ -0,0 +1,66 @@
name: SchCache Change By App Connect And Create ADSI Object
id: 991eb510-0fc6-11ec-82d3-acde48001122
version: 1
date: '2021-09-07'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: This analytic is to detect an application try to connect and create ADSI
Object to do LDAP query. Every time an application connects to the directory and
attempts to create an ADSI object, the Active Directory Schema is checked for changes.
If it has changed since the last connection, the schema is downloaded and stored
in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache
or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious
application like blackmatter ransomware that use ADS object api to execute ldap
query. having a good list of ldap or normal AD query tool used within the network
is a good start to reduce the noise.
search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
= "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time)
as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name
Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `schcache_change_by_app_connect_and_create_adsi_object_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: normal application like mmc.exe and other ldap query tool may
trigger this detections.
references:
- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- blackMatter ransomware
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1087.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Image
- TargetFilename
- EventCode
- process_id
- process_name
- Computer
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- source:endpoint
- stage:Discovery
message: process $Image$ create a file $TargetFilename$ in host $Computer$
observable:
- name: Computer
type: Hostname
role:
- Victim
automated_detection_testing: passed
detections/endpoint/system_information_discovery_detection.yml
+14 -9
View File
@@ -1,7 +1,7 @@
name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
date: '2020-10-12'
version: 2
date: '2021-09-07'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
@@ -9,13 +9,18 @@ datamodel:
description: Detect system information discovery techniques used by attackers to understand
configurations of the system to further exploit it.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
> 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest
| where dc_processes_by_dest
> 2
| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest parent_process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
dist/devsecops/bin/README
Vendored
+1
View File
@@ -0,0 +1 @@
This is where you put any scripts you want to add to this app.
dist/devsecops/default/analytic_stories.conf
Vendored
+27
View File
@@ -0,0 +1,27 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### STORIES ###
[Dev Sec Ops]
category = Cloud Security
creation_date = 2021-08-18
modification_date = 2021-08-18
id = 0ca8c38e-631e-4b81-940c-f9c5450ce41e
version = 1
reference = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
detection_searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1212", "T1526"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud', 'Dev Sec Ops Analytics']
#### END STORIES ####
dist/devsecops/default/app.conf
Vendored
+16
View File
@@ -0,0 +1,16 @@
#
# Splunk app configuration file
#
[install]
is_configured = 0
[ui]
is_visible = 1
label = Dev Sec Ops Analytics
[launcher]
author = Splunk Threat Research Team
description =
version = 1.0.0
dist/devsecops/default/collections.conf
Vendored
+55
View File
@@ -0,0 +1,55 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
[api_call_by_user_baseline]
enforceTypes = false
replicate = false
[cloud_instances_enough_data]
enforceTypes = false
replicate = false
[previously_seen_cloud_api_calls_per_user_role]
enforceTypes = false
replicate = false
[previously_seen_cloud_compute_creations_by_user]
enforceTypes = false
replicate = false
[previously_seen_cloud_compute_images]
enforceTypes = false
replicate = false
[previously_seen_cloud_compute_instance_types]
enforceTypes = false
replicate = false
[previously_seen_cloud_instance_modifications_by_user]
enforceTypes = false
replicate = false
[previously_seen_cloud_provisioning_activity_sources]
enforceTypes = false
replicate = false
[previously_seen_cloud_regions]
enforceTypes = false
replicate = false
[previously_seen_running_windows_services]
enforceTypes = false
replicate = false
[previously_seen_users_console_logins]
enforceTypes = false
replicate = false
[zoom_first_time_child_process]
enforceTypes = false
replicate = false
dist/devsecops/default/data/ui/nav/default.xml
Vendored
+7
View File
@@ -0,0 +1,7 @@
<nav search_view="search">
<view name="analytics" default='true' />
<view name="user_analytics" />
<view name="repository_analytics" />
<view name="search" />
<view name="dashboards" />
</nav>
dist/devsecops/default/data/ui/views/README
Vendored
+1
View File
@@ -0,0 +1 @@
Add all the views that your app needs in this directory
dist/devsecops/default/data/ui/views/analytics.xml
Vendored
+7
View File
File diff suppressed because one or more lines are too long
dist/devsecops/default/data/ui/views/repository_analytics.xml
Vendored
+7
View File
File diff suppressed because one or more lines are too long
dist/devsecops/default/data/ui/views/user_analytics.xml
Vendored
+7
View File
File diff suppressed because one or more lines are too long
dist/devsecops/default/es_investigations.conf
Vendored
+10
View File
@@ -0,0 +1,10 @@
[panel_group://workbench_panel_group_dev_sec_ops]
label = Dev Sec Ops
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
dist/devsecops/default/macros.conf
Vendored
+405
View File
@@ -0,0 +1,405 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
[aws_cloudwatchlogs_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_config]
definition = sourcetype=aws:config
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_description]
definition = sourcetype="aws:description"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_ecr_users]
definition = userName IN (user)
description = specify the user allowed to push Images to AWS ECR.
[aws_s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_securityhub_finding]
definition = sourcetype="aws:securityhub:finding"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_securityhub_firehose]
definition = sourcetype="aws:securityhub:firehose"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[brand_abuse_dns]
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[brand_abuse_email]
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[brand_abuse_web]
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[cisco_networks]
definition = eventtype=cisco_ios
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[cloud_api_calls_from_previously_unseen_user_roles_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new commands from user roles
[cloudtrail]
definition = sourcetype=aws:cloudtrail
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatch_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatch_vpc]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatchlogs_vpcflow]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[dynamic_dns_providers]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
[dynamic_dns_web_traffic]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This is a description
[ec2_modification_api_calls]
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
[evilginx_phishlets_0365]
definition = (query=login* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
[evilginx_phishlets_amazon]
definition = (query=fls-na* AND query = www* AND query=images*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
[evilginx_phishlets_aws]
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
[evilginx_phishlets_facebook]
definition = (query=www* AND query = m* AND query=static*)
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
[evilginx_phishlets_github]
definition = (query=api* AND query = github*)
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
[evilginx_phishlets_google]
definition = (query=accounts* AND query=ssl* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Google
[evilginx_phishlets_outlook]
definition = (query=outlook* AND query=login* AND query=account*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
[f5_bigip_rogue]
definition = index=netops sourcetype="f5:bigip:rogue"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[filter_rare_process_allow_list]
definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
description = This macro is intended to allow_list processes that have been definied as rare
[github]
definition = sourcetype=aws:firehose:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[google_gcp_pubnet_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.
[google_gcp_pubsub_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gsuite_drive]
definition = sourcetype=gsuite:drive:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gsuite_gmail]
definition = sourcetype=gsuite:gmail:bigquery
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[is_windows_system_file]
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory
[kube_objects_events]
definition = sourcetype=kube:objects:events
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[kubernetes_azure]
definition = sourcetype=mscs:storage:blob:json
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
[kubernetes_container_controller]
definition = sourcetype=kube:container:controller
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
[linux_hosts]
definition = index=*
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[netbackup]
definition = sourcetype="netbackup_logs"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[network_acl_events]
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
description = This is a list of AWS event names that are associated with Network ACLs
[notable]
definition = index=notable
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[o365_management_activity]
definition = sourcetype=o365:management:activity
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[okta]
definition = eventtype=okta_log
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[osquery_process]
definition = eventtype="osquery-process"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[powershell]
definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[previously_seen_cloud_api_calls_per_user_role_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud api calls per user role
[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
[previously_seen_cloud_compute_image_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
[previously_seen_cloud_compute_images_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance images
[previously_seen_cloud_compute_instance_type_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance types
[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
[previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
[previously_seen_cloud_provisioning_activity_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud provisioning locations
[previously_seen_cloud_region_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud regions
[previously_seen_cloud_regions_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
[previously_seen_windows_services_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of Windows services
[previously_seen_windows_services_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new Windows services
[previously_seen_zoom_child_processes_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of zoom child processes
[previously_seen_zoom_child_processes_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new zoom child processes
[previously_unseen_cloud_provisioning_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new provisioning activities
[printservice]
definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[process_esentutl]
definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[prohibited_apps_launching_cmd]
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
description = This macro outputs a list of process that should not be the parent process of cmd.exe
[prohibited_softwares]
definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True
description = This macro limits the output to process_names that have been marked as prohibited
[ransomware_extensions]
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
description = This macro limits the output to files that have extensions associated with ransomware
[ransomware_notes]
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
description = This macro limits the output to files that have been identified as a ransomware note
[remove_valid_domains]
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
description = This macro removes valid domains from the output
[s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
[security_content_ctime(1)]
args = field
definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
description = convert epoch time to string
[security_content_summariesonly]
definition = summariesonly=false allow_old_summaries=true
description = search data model's summaries only
[security_group_api_calls]
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
description = This macro is a list of AWS event names associated with security groups
[stream_dns]
definition = sourcetype=stream:dns
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[stream_http]
definition = sourcetype=stream:http
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[stream_tcp]
definition = sourcetype=stream:tcp
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[suspicious_email_attachments]
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
description = This macro limits the output to email attachments that have suspicious extensions
[suspicious_writes]
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
description = This macro limites the output to file names that have been marked as suspicious
[sysmon]
definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[system_network_configuration_discovery_tools]
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description = This macro is a list of process that can be used to discover the network configuration
[uncommon_processes]
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
description = This macro limits the output to processes that have been marked as uncommon
[wineventlog_security]
definition = eventtype=wineventlog_security
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wineventlog_system]
definition = eventtype=wineventlog_system
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wmi]
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zeek_rpc]
definition = index=zeek sourcetype="zeek:rpc:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zeek_ssl]
definition = index=zeek sourcetype="zeek:ssl:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_ecr_container_scanning_findings_high_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_scanning_findings_medium_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_upload_outside_business_hours_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_upload_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_suspicious_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_drive_share_in_external_email_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_suspicious_subject_with_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_with_known_abuse_web_service_link_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_outbound_email_with_attachment_to_external_domain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_suspicious_shared_file_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_nginx_ingress_lfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_nginx_ingress_rfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_scanner_image_pulling_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/devsecops/default/props.conf
Vendored
+2
View File
@@ -0,0 +1,2 @@
[stash]
lookup_image_to_repository = images_to_repository image OUTPUT repository
dist/devsecops/default/savedsearches.conf
Vendored
+749
View File
@@ -0,0 +1,749 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### ESCU DETECTIONS ###
[ESCU - AWS ECR Container Scanning Findings High - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings High
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` | collect index=findings
[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Low Informational Unknown
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter` | collect index=findings
[ESCU - AWS ECR Container Scanning Findings Medium - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Medium
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` | collect index=findings
[ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded outside business hours from $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.notable.param.rule_title = AWS ECR Container Upload Outside Business Hours
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter` | collect index=findings
[ESCU - AWS ECR Container Upload Unknown User - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Unknown User - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded from unknown user $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Unknown User - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.notable.param.rule_title = AWS ECR Container Upload Unknown User
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter` | collect index=findings
[ESCU - AWS Excessive Security Scanning - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = While this search has no known false positives.
action.escu.creation_date = 2021-04-13
action.escu.modification_date = 2021-04-13
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["AWS User Monitoring"]
action.risk = 1
action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$.
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS Excessive Security Scanning - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter` | collect index=findings
[ESCU - GSuite Email Suspicious Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GSuite Email Suspicious Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.notable.param.rule_title = GSuite Email Suspicious Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments subject destination{}.address source.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_attachment_filter` | collect index=findings
[ESCU - Gsuite Drive Share In External Email - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin or normal user may share files to customer and external team.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.notable.param.rule_title = Gsuite Drive Share In External Email
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)" | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` | collect index=findings
[ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.notable.param.rule_title = Gsuite Email Suspicious Subject With Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments subject destination{}.address source.address plan | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_subject_with_attachment_filter` | collect index=findings
[ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
action.escu = 0
action.escu.enabled = 1
description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.notable.param.rule_title = Gsuite Email With Known Abuse Web Service Link
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter` | collect index=findings
[ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.notable.param.rule_title = Gsuite Outbound Email With Attachment To External Domain
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" | eval phase="plan" | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime by dest_domain phase | where numSrcAddresses < 20 |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter` | collect index=findings
[ESCU - Gsuite Suspicious Shared File Name - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.notable.param.rule_title = Gsuite Suspicious Shared File Name
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` | collect index=findings
[ESCU - Kubernetes Nginx Ingress LFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-20
action.escu.modification_date = 2021-08-20
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Local File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.notable.param.rule_title = Kubernetes Nginx Ingress LFI
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter` | collect index=findings
[ESCU - Kubernetes Nginx Ingress RFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Remote File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.notable.param.rule_title = Kubernetes Nginx Ingress RFI
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter` | collect index=findings
[ESCU - Kubernetes Scanner Image Pulling - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-24
action.escu.modification_date = 2021-08-24
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Scanner Image Pulling - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Kubernetes Scanner image pulled on host $host$
action.risk.param._risk = [{"threat_object_field": "host", "threat_object_type": "entity"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Scanner Image Pulling - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "type": "Entity"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.notable.param.rule_title = Kubernetes Scanner Image Pulling
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host | eval phase="operate" | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter` | collect index=findings
### END ESCU DETECTIONS ###
### ESCU BASELINES ###
### ESCU RESPONSE TASKS ###
### END ESCU RESPONSE TASKS ###
### USAGE DASHBOARD CONFIGURATIONS ###
[escu-metrics-usage]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
[escu-metrics-search]
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
[escu-metrics-search-events]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
[escu-metrics-search-longest-runtime]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
disabled = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
[escu-metrics-usage-search]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
enableSched = 1
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
### END OF USAGE DASHBOARD CONFIGURATIONS ###
dist/devsecops/default/transforms.conf
Vendored
+271
View File
@@ -0,0 +1,271 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
[api_call_by_user_baseline]
collection = api_call_by_user_baseline
external_type = kvstore
# description = A collection that will contain the baseline information for number of AWS API calls per user
fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
[attacker_tools]
filename = attacker_tools.csv
default_match = false
case_sensitive_match = false
# description = A list of tools used by attackers
match_type = WILDCARD(attacker_tool_names)
min_matches = 1
[aws_service_accounts]
filename = aws_service_accounts.csv
# description = A lookup file that will contain AWS Service accounts
[baseline_blocked_outbound_connections]
filename = baseline_blocked_outbound_connections.csv
# description = A lookup file that will contain the baseline information for number of blocked outbound connections
[brandMonitoring_lookup]
filename = brand_monitoring.csv
default_match = false
# description = A file that contains look-a-like domains for brands that you want to monitor
match_type = WILDCARD(domain)
min_matches = 1
[cloud_instances_enough_data]
collection = cloud_instances_enough_data
external_type = kvstore
default_match = false
# description = A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
match_type = WILDCARD(filter)
fields_list = _key, filter, enough_data
[csc_lookup]
filename = csc_lookup.csv
# description = The CSC control numbers and names
min_matches = 1
[discovered_dns_records]
filename = discovered_dns_records.csv
default_match = false
# description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
min_matches = 1
[domains]
filename = domains.csv
# description = A list of domains that can be ignored
[dynamic_dns_providers_default]
filename = dynamic_dns_providers_default.csv
case_sensitive_match = false
# description = A list of dynammic dns providers that should not be modified
match_type = WILDCARD(dynamic_dns_domains)
[dynamic_dns_providers_local]
filename = dynamic_dns_providers_local.csv
case_sensitive_match = false
# description = A list of dynammic dns providers that can be modified
match_type = WILDCARD(dynamic_dns_domains)
[escu_search_id_lookup]
filename = escu_search_id.csv
# description = A placeholder lookup file to hold information for ESCU Usage dashboard
[is_suspicious_file_extension_lookup]
filename = is_suspicious_file_extension_lookup.csv
# description = A list of suspicious extensions for email attachments
match_type = WILDCARD(file_name)
[is_windows_system_file]
filename = is_windows_system_file.csv
default_match = false
# description = A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
min_matches = 1
[legit_domains]
filename = legit_domains.csv
# description = A list of legit domains to be used as an ignore list for possible phishing sites
[local_file_inclusion_paths]
filename = local_file_inclusion_paths.csv
default_match = false
case_sensitive_match = false
# description = A list of interesting files in a local file inclusion attack
match_type = WILDCARD(local_file_inclusion_paths)
min_matches = 1
[lookup_rare_process_allow_list_default]
filename = rare_process_allow_list_default.csv
default_match = false
case_sensitive_match = false
# description = A list of rare processes that are legitimate that is provided by Splunk
match_type = WILDCARD(process)
min_matches = 1
[lookup_rare_process_allow_list_local]
filename = rare_process_allow_list_local.csv
default_match = false
case_sensitive_match = false
# description = A list of rare processes that are legitimate provided by the end user
match_type = WILDCARD(process)
min_matches = 1
[lookup_uncommon_processes_default]
filename = uncommon_processes_default.csv
case_sensitive_match = false
# description = A list of processes that are not common
match_type = WILDCARD(process)
[lookup_uncommon_processes_local]
filename = uncommon_processes_local.csv
case_sensitive_match = false
# description = A list of processes that are not common
match_type = WILDCARD(process)
[network_acl_activity_baseline]
filename = network_acl_activity_baseline.csv
# description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
[previously_seen_S3_access_from_remote_ip]
filename = previously_seen_S3_access_from_remote_ip.csv
# description = A placeholder for a list of IPs that have access S3
[previously_seen_api_calls_from_user_roles]
filename = previously_seen_api_calls_from_user_roles.csv
# description = A placeholder for a list of AWS API calls for each user role
[previously_seen_aws_cross_account_activity]
filename = previously_seen_aws_cross_account_activity.csv
# description = A placeholder for a list of AWS accounts and assumed roles
[previously_seen_aws_regions]
filename = previously_seen_aws_regions.csv
default_match = false
# description = A place holder for a list of used AWS regions
min_matches = 1
[previously_seen_cloud_api_calls_per_user_role]
collection = previously_seen_cloud_api_calls_per_user_role
external_type = kvstore
# description = A table of users, commands, and the first and last time that they have been seen
fields_list = _key, user, command, firstTimeSeen, lastTimeSeen, enough_data
[previously_seen_cloud_compute_creations_by_user]
collection = previously_seen_cloud_compute_creations_by_user
external_type = kvstore
# description = A table of previously seen users creating cloud instances
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
[previously_seen_cloud_compute_images]
collection = previously_seen_cloud_compute_images
external_type = kvstore
# description = A table of previously seen Cloud image IDs
fields_list = _key, firstTimeSeen, lastTimeSeen, image_id, enough_data
[previously_seen_cloud_compute_instance_types]
collection = previously_seen_cloud_compute_instance_types
external_type = kvstore
# description = A place holder for a list of used cloud compute instance types
fields_list = _key, firstTimeSeen, lastTimeSeen, instance_type, enough_data
[previously_seen_cloud_instance_modifications_by_user]
collection = previously_seen_cloud_instance_modifications_by_user
external_type = kvstore
# description = A table of users seen making instance modifications, and the first and last time that the activity was observed
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
[previously_seen_cloud_provisioning_activity_sources]
collection = previously_seen_cloud_provisioning_activity_sources
external_type = kvstore
# description = A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
fields_list = _key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
[previously_seen_cloud_regions]
collection = previously_seen_cloud_regions
external_type = kvstore
# description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data
[previously_seen_cmd_line_arguments]
filename = previously_seen_cmd_line_arguments.csv
# description = A placeholder for a list of cmd line arugments that been seen before
[previously_seen_ec2_modifications_by_user]
filename = previously_seen_ec2_modifications_by_user.csv
# description = A place holder for a list of AWS EC2 modifications done by each user
[previously_seen_running_windows_services]
collection = previously_seen_running_windows_services
external_type = kvstore
# description = A placeholder for the list of Windows Services running
fields_list = _key, service, firstTimeSeen, lastTimeSeen
[previously_seen_users_console_logins]
collection = previously_seen_users_console_logins
external_type = kvstore
# description = A table of users seen doing console logins, and the first and last time that the activity was observed
fields_list = _key, firstTime, lastTime, user, src, City, Region, Country
[prohibited_apps_launching_cmd]
filename = prohibited_apps_launching_cmd.csv
# description = A list of processes that should not be launching cmd.exe
match_type = WILDCARD(prohibited_applications)
[prohibited_processes]
filename = prohibited_processes.csv
# description = A list of processes that have been marked as prohibited
[prohibited_softwares]
filename = prohibited_softwares.csv
# description = A list of processes that have been marked as prohibited
[ransomware_extensions_lookup]
filename = ransomware_extensions.csv
default_match = false
case_sensitive_match = false
# description = A list of file extensions that are associated with ransomware
match_type = WILDCARD(Extensions)
min_matches = 1
[ransomware_notes_lookup]
filename = ransomware_notes.csv
default_match = false
# description = A list of file names that are ransomware note files
match_type = WILDCARD(ransomware_notes)
min_matches = 1
[s3_deletion_baseline]
filename = s3_deletion_baseline.csv
# description = A placeholder for the baseline information for AWS S3 deletions
[security_group_activity_baseline]
filename = security_group_activity_baseline.csv
# description = A placeholder for the baseline information for AWS security groups
[security_services_lookup]
filename = security_services.csv
default_match = false
# description = A list of services that deal with security
match_type = WILDCARD(service)
min_matches = 1
[suspicious_writes_lookup]
filename = suspicious_files.csv
default_match = false
# description = A list of suspicious file names
match_type = WILDCARD(file)
min_matches = 1
[zoom_first_time_child_process]
collection = zoom_first_time_child_process
external_type = kvstore
# description = A list of suspicious file names
fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen
### Default transforms definitions for the lookup files we ship ###
[mitre_enrichment]
filename = mitre_enrichment.csv
# description = A lookup file that is created by generate.py
dist/devsecops/default/use_case_library.conf
Vendored
+179
View File
@@ -0,0 +1,179 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### STORIES ###
[analytic_story://Dev Sec Ops]
category = Cloud Security
last_updated = 2021-08-18
version = 1
references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
### END STORIES ###
### DETECTIONS ###
[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Upload Unknown User - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives.
providing_technologies = []
[savedsearch://ESCU - GSuite Email Suspicious Attachment - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []
[savedsearch://ESCU - Gsuite Drive Share In External Email - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
known_false_positives = network admin or normal user may share files to customer and external team.
providing_technologies = []
[savedsearch://ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
providing_technologies = []
[savedsearch://ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
type = detection
asset_type =
confidence = medium
explanation = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
providing_technologies = []
[savedsearch://ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []
[savedsearch://ESCU - Gsuite Suspicious Shared File Name - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
providing_technologies = []
[savedsearch://ESCU - Kubernetes Nginx Ingress LFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Kubernetes Nginx Ingress RFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Kubernetes Scanner Image Pulling - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
### END DETECTIONS ###
### RESPONSE TASKS ###
### END RESPONSE TASKS ###
dist/devsecops/default/workflow_actions.conf
Vendored
+1
View File
@@ -0,0 +1 @@
dist/devsecops/lookups/attacker_tools.csv
Vendored
+26
View File
@@ -0,0 +1,26 @@
attacker_tool_names,description
remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system.
pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system.
nc.exe,This process is an open source tool used for network communications.
wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
cain.exe,This process is associated with a tool used to collect user credentials and execute attacks.
nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host.
isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
at.exe,This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
getmail.exe,This process is seen to be used by attackers to extract email files from host machines.
ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
masscan.exe,This executable was delivered in the XMRig Crypto Miner
Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
ns.exe,A commonly used tool used by attackers to scan and map file shares
SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
1 attacker_tool_names description
2 remcom.exe This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
3 pwdump.exe This process is associated with a tool used to dump password hashes on a Windows system.
4 pwdump2.exe This process is associated with a tool used to dump password hashes on a Windows system.
5 nc.exe This process is an open source tool used for network communications.
6 wce.exe This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
7 cain.exe This process is associated with a tool used to collect user credentials and execute attacks.
8 nmap.exe This process is an open source network mapping tool used to identify hosts and listening services on a network.
9 kidlogger.exe This process is associated with a tool used to collect keyboard input on a host.
10 isass.exe This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
11 svch0st.exe This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
12 at.exe This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
13 getmail.exe This process is seen to be used by attackers to extract email files from host machines.
14 ntdll.exe This process was identified as malicious by DHS Alert TA18-074A.
15 netpass.exe This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
16 WebBrowserPassView.exe This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
17 OutlookAddressBookView.exe This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
18 mailpv.exe This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
19 NLBrute.exe A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
20 selfdel.exe This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
21 masscan.exe This executable was delivered in the XMRig Crypto Miner
22 Massscan_GUI.exe This executable was delivered in the XMRig Crypto Miner
23 KPortScan3.exe This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
24 NLAChecker.exe A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
25 ns.exe A commonly used tool used by attackers to scan and map file shares
26 SilverBullet.exe Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
dist/devsecops/lookups/aws_service_accounts.csv
Vendored
+1
View File
@@ -0,0 +1 @@
identity
1 identity
dist/devsecops/lookups/baseline_blocked_outbound_connections.csv
Vendored
+1
View File
@@ -0,0 +1 @@
src_ip,numDataPoints,latestCount,avgBlockedConnections,stdevBlockedConnections
1 src_ip numDataPoints latestCount avgBlockedConnections stdevBlockedConnections
dist/devsecops/lookups/brand_monitoring.csv
Vendored
+1
View File
@@ -0,0 +1 @@
domain,domain_abuse
1 domain domain_abuse
dist/devsecops/lookups/csc_lookup.csv
Vendored
+21
View File
@@ -0,0 +1,21 @@
number, name
1, Inventory of Authorized and Unauthorized Devices
2, Inventory of Authorized and Unauthorized Software
3, Secure Configuration of End-User Devices
4, Continuous Vulnerability Assessment & Remediation
5, Controlled Use of Administrative Privileges
6, Maintenance Monitoring and Analysis of Audit Logs
7, Email & Web Browser Protections
8, Malware Defense
9, Limitation & Control of Network Ports-Protocols & Services
10, Data Recovery Capability
11, Secure Configuration of Network Devices
12, Boundary Defense
13, Data Protection
14, Controlled Access Based on Need to Know
15, Wireless Access Control
16, Account Monitoring and Control
17, Security Skills Assessment and Appropriate Training
18, Application Software Security
19, Incident Response and Management
20, Penetration Tests and Red Team Exercises
1 number name
2 1 Inventory of Authorized and Unauthorized Devices
3 2 Inventory of Authorized and Unauthorized Software
4 3 Secure Configuration of End-User Devices
5 4 Continuous Vulnerability Assessment & Remediation
6 5 Controlled Use of Administrative Privileges
7 6 Maintenance Monitoring and Analysis of Audit Logs
8 7 Email & Web Browser Protections
9 8 Malware Defense
10 9 Limitation & Control of Network Ports-Protocols & Services
11 10 Data Recovery Capability
12 11 Secure Configuration of Network Devices
13 12 Boundary Defense
14 13 Data Protection
15 14 Controlled Access Based on Need to Know
16 15 Wireless Access Control
17 16 Account Monitoring and Control
18 17 Security Skills Assessment and Appropriate Training
19 18 Application Software Security
20 19 Incident Response and Management
21 20 Penetration Tests and Red Team Exercises
dist/devsecops/lookups/discovered_dns_records.csv
Vendored
+1
View File
@@ -0,0 +1 @@
count,domain,type,query,answer
1 count domain type query answer
dist/devsecops/lookups/domains.csv
Vendored
+1
View File
@@ -0,0 +1 @@
domain,isValidDomain
1 domain isValidDomain
dist/devsecops/lookups/dynamic_dns_providers_default.csv
Vendored
+91976
View File
File diff suppressed because it is too large Load Diff
dist/devsecops/lookups/dynamic_dns_providers_local.csv
Vendored
+1
View File
@@ -0,0 +1 @@
dynamic_dns_domains, isDynDNS_local
1 dynamic_dns_domains isDynDNS_local
dist/devsecops/lookups/escu_search_id.csv
Vendored
+1
View File
@@ -0,0 +1 @@
savedsearch_name, search_id, user, _time, usage
1 savedsearch_name search_id user _time usage
dist/devsecops/lookups/is_suspicious_file_extension_lookup.csv
Vendored
+52
View File
@@ -0,0 +1,52 @@
file_name,suspicious
*.avi.com,true
*.avi.exe,true
*.doc.com,true
*.doc.exe,true
*.docx.com,true
*.docx.exe,true
*.jpg.com,true
*.jpg.exe,true
*.jpeg.com,true
*.jpeg.exe,true
*.mpg.com,true
*.mpg.exe,true
*.mpg2.com,true
*.mpg2.exe,true
*.mpeg.com,true
*.mpeg.exe,true
*.pdf.com,true
*.pdf.exe,true
*.png.com,true
*.png.exe,true
*.ppt.com,true
*.ppt.exe,true
*.pptx.com,true
*.pptx.exe,true
*.swf.com,true
*.swf.exe,true
*.xls.com,true
*.xls.exe,true
*.xlsx.com,true
*.xlsx.exe,true
*.zip.com,true
*.zip.exe,true
*.bat,true
*.chm,true
*.com,true
*.cmd,true
*.cpl,true
*.exe,true
*.hlp,true
*.hta,true
*.jar,true
*.js,true
*.msi,true
*.pif,true
*.ps1,true
*.rar,true
*.reg,true
*.scr,true
*.vbe,true
*.vbs,true
*.wsf,true
1 file_name suspicious
2 *.avi.com true
3 *.avi.exe true
4 *.doc.com true
5 *.doc.exe true
6 *.docx.com true
7 *.docx.exe true
8 *.jpg.com true
9 *.jpg.exe true
10 *.jpeg.com true
11 *.jpeg.exe true
12 *.mpg.com true
13 *.mpg.exe true
14 *.mpg2.com true
15 *.mpg2.exe true
16 *.mpeg.com true
17 *.mpeg.exe true
18 *.pdf.com true
19 *.pdf.exe true
20 *.png.com true
21 *.png.exe true
22 *.ppt.com true
23 *.ppt.exe true
24 *.pptx.com true
25 *.pptx.exe true
26 *.swf.com true
27 *.swf.exe true
28 *.xls.com true
29 *.xls.exe true
30 *.xlsx.com true
31 *.xlsx.exe true
32 *.zip.com true
33 *.zip.exe true
34 *.bat true
35 *.chm true
36 *.com true
37 *.cmd true
38 *.cpl true
39 *.exe true
40 *.hlp true
41 *.hta true
42 *.jar true
43 *.js true
44 *.msi true
45 *.pif true
46 *.ps1 true
47 *.rar true
48 *.reg true
49 *.scr true
50 *.vbe true
51 *.vbs true
52 *.wsf true
dist/devsecops/lookups/is_windows_system_file.csv
Vendored
+753
View File
@@ -0,0 +1,753 @@
filename,systemFile
acu.exe,true
AgentService.exe,true
aitstatic.exe,true
alg.exe,true
AppHostRegistrationVerifier.exe,true
appidcertstorecheck.exe,true
appidpolicyconverter.exe,true
appidtel.exe,true
ApplicationFrameHost.exe,true
ApplySettingsTemplateCatalog.exe,true
AppVClient.exe,true
AppVDllSurrogate.exe,true
AppVNice.exe,true
AppVStreamingUX.exe,true
ARP.EXE,true
at.exe,true
AtBroker.exe,true
attrib.exe,true
audiodg.exe,true
auditpol.exe,true
AuthHost.exe,true
autochk.exe,true
autoconv.exe,true
autofmt.exe,true
AxInstUI.exe,true
backgroundTaskHost.exe,true
BackgroundTransferHost.exe,true
bcastdvr.exe,true
bcdboot.exe,true
bcdedit.exe,true
BioIso.exe,true
bitsadmin.exe,true
bootcfg.exe,true
bootim.exe,true
bridgeunattend.exe,true
browser_broker.exe,true
bthudtask.exe,true
ByteCodeGenerator.exe,true
cacls.exe,true
calc.exe,true
CameraSettingsUIHost.exe,true
CastSrv.exe,true
CertEnrollCtrl.exe,true
certreq.exe,true
certutil.exe,true
change.exe,true
changepk.exe,true
charmap.exe,true
CheckNetIsolation.exe,true
chglogon.exe,true
chgport.exe,true
chgusr.exe,true
chkdsk.exe,true
chkntfs.exe,true
choice.exe,true
cipher.exe,true
cleanmgr.exe,true
cliconfg.exe,true
clip.exe,true
ClipUp.exe,true
CloudExperienceHostBroker.exe,true
CloudNotifications.exe,true
CloudStorageWizard.exe,true
cmd.exe,true
cmdkey.exe,true
cmdl32.exe,true
cmmon32.exe,true
cmstp.exe,true
cofire.exe,true
colorcpl.exe,true
comp.exe,true
compact.exe,true
CompatTelRunner.exe,true
CompMgmtLauncher.exe,true
ComputerDefaults.exe,true
Configure-SMRemoting.exe,true
conhost.exe,true
consent.exe,true
control.exe,true
convert.exe,true
CredentialUIBroker.exe,true
credwiz.exe,true
cscript.exe,true
csrss.exe,true
ctfmon.exe,true
cttune.exe,true
cttunesvr.exe,true
dasHost.exe,true
DataExchangeHost.exe,true
DataSenseLiveTileTask.exe,true
dccw.exe,true
dcgpofix.exe,true
dcomcnfg.exe,true
dcpromo.exe,true
ddodiag.exe,true
Defrag.exe,true
DeviceCensus.exe,true
DeviceEject.exe,true
DeviceEnroller.exe,true
DevicePairingWizard.exe,true
DeviceProperties.exe,true
DFDWiz.exe,true
dfrgui.exe,true
dfsrdiag.exe,true
dialer.exe,true
DIMC.exe,true
diskpart.exe,true
diskperf.exe,true
diskraid.exe,true
diskshadow.exe,true
DiskSnapshot.exe,true
Dism.exe,true
dispdiag.exe,true
DisplaySwitch.exe,true
djoin.exe,true
dllhost.exe,true
dllhst3g.exe,true
dmcertinst.exe,true
dmcfghost.exe,true
DmNotificationBroker.exe,true
DmOmaCpMo.exe,true
dnscacheugc.exe,true
doskey.exe,true
dpapimig.exe,true
DpiScaling.exe,true
dpnsvr.exe,true
driverquery.exe,true
drvcfg.exe,true
drvinst.exe,true
DsmUserTask.exe,true
dsregcmd.exe,true
dstokenclean.exe,true
dvdplay.exe,true
dwm.exe,true
DWWIN.EXE,true
dxdiag.exe,true
Dxpserver.exe,true
Eap3Host.exe,true
EaseOfAccessDialog.exe,true
easinvoker.exe,true
EasPoliciesBrokerHost.exe,true
EDPCleanup.exe,true
edpnotify.exe,true
efsui.exe,true
EhStorAuthn.exe,true
embeddedapplauncher.exe,true
EmbeddedAppLauncherConfig.exe,true
escUnattend.exe,true
esentutl.exe,true
eudcedit.exe,true
eventcreate.exe,true
eventvwr.exe,true
expand.exe,true
extrac32.exe,true
fc.exe,true
find.exe,true
findstr.exe,true
finger.exe,true
fixmapi.exe,true
fltMC.exe,true
fodhelper.exe,true
Fondue.exe,true
fontdrvhost.exe,true
fontview.exe,true
forfiles.exe,true
fsavailux.exe,true
fsquirt.exe,true
fsutil.exe,true
ftp.exe,true
GameBarPresenceWriter.exe,true
GamePanel.exe,true
GenValObj.exe,true
getmac.exe,true
gpresult.exe,true
gpscript.exe,true
gpupdate.exe,true
grpconv.exe,true
hdwwiz.exe,true
help.exe,true
HOSTNAME.EXE,true
hvax64.exe,true
hvix64.exe,true
hvloader.exe,true
hwrcomp.exe,true
hwrreg.exe,true
iashost.exe,true
icacls.exe,true
IcsEntitlementHost.exe,true
icsunattend.exe,true
ie4uinit.exe,true
ieUnatt.exe,true
iexpress.exe,true
immersivetpmvscmgrsvr.exe,true
InfDefaultInstall.exe,true
InstallAgent.exe,true
InstallAgentUserBroker.exe,true
ipconfig.exe,true
iscsicli.exe,true
iscsicpl.exe,true
isoburn.exe,true
klist.exe,true
ksetup.exe,true
ktmutil.exe,true
ktpass.exe,true
label.exe,true
LanguageComponentsInstallerComHandler.exe,true
LaunchTM.exe,true
LaunchWinApp.exe,true
LbfoAdmin.exe,true
LegacyNetUXHost.exe,true
LicenseManagerShellext.exe,true
licensingdiag.exe,true
LicensingUI.exe,true
LocationNotificationWindows.exe,true
Locator.exe,true
LockAppHost.exe,true
LockScreenContentServer.exe,true
lodctr.exe,true
logagent.exe,true
logman.exe,true
logoff.exe,true
LogonUI.exe,true
lpkinstall.exe,true
lpksetup.exe,true
lpremove.exe,true
LsaIso.exe,true
lsass.exe,true
Magnify.exe,true
makecab.exe,true
mavinject.exe,true
MbaeParserTask.exe,true
mblctr.exe,true
mcbuilder.exe,true
MDEServer.exe,true
MDMAgent.exe,true
MDMAppInstaller.exe,true
MdmDiagnosticsTool.exe,true
MdRes.exe,true
MdSched.exe,true
mfpmp.exe,true
Microsoft.Uev.CscUnpinTool.exe,true
Microsoft.Uev.SyncController.exe,true
mmc.exe,true
mobsync.exe,true
mountvol.exe,true
mpnotify.exe,true
MpSigStub.exe,true
MRINFO.EXE,true
MRT-KB890830.exe,true
MRT.exe,true
MSchedExe.exe,true
msconfig.exe,true
msdt.exe,true
msdtc.exe,true
msfeedssync.exe,true
msg.exe,true
mshta.exe,true
msiexec.exe,true
msinfo32.exe,true
mspaint.exe,true
MsSpellCheckingHost.exe,true
mstsc.exe,true
mtstocom.exe,true
MuiUnattend.exe,true
MultiDigiMon.exe,true
MusNotification.exe,true
MusNotificationUx.exe,true
Narrator.exe,true
nbtstat.exe,true
ndadmin.exe,true
net.exe,true
net1.exe,true
netbtugc.exe,true
netcfg.exe,true
NetCfgNotifyObjectHost.exe,true
netdom.exe,true
NetEvtFwdr.exe,true
NetHost.exe,true
netiougc.exe,true
Netplwiz.exe,true
netsh.exe,true
NETSTAT.EXE,true
newdev.exe,true
nltest.exe,true
notepad.exe,true
nslookup.exe,true
ntoskrnl.exe,true
ntprint.exe,true
odbcad32.exe,true
odbcconf.exe,true
omadmclient.exe,true
omadmprc.exe,true
openfiles.exe,true
OpenWith.exe,true
OptionalFeatures.exe,true
osk.exe,true
PackagedCWALauncher.exe,true
PackageInspector.exe,true
PasswordOnWakeSettingFlyout.exe,true
PATHPING.EXE,true
pcalua.exe,true
pcaui.exe,true
pcwrun.exe,true
perfmon.exe,true
phoneactivate.exe,true
PickerHost.exe,true
PING.EXE,true
PkgMgr.exe,true
plasrv.exe,true
PnPUnattend.exe,true
pnputil.exe,true
poqexec.exe,true
powercfg.exe,true
PresentationHost.exe,true
PresentationSettings.exe,true
prevhost.exe,true
print.exe,true
PrintBrmUi.exe,true
PrintDialogHost.exe,true
PrintDialogHost3D.exe,true
printfilterpipelinesvc.exe,true
PrintIsolationHost.exe,true
printui.exe,true
proquota.exe,true
psr.exe,true
pwlauncher.exe,true
qappsrv.exe,true
qprocess.exe,true
query.exe,true
quser.exe,true
qwinsta.exe,true
rasdial.exe,true
rdpclip.exe,true
rdpinit.exe,true
rdpinput.exe,true
RdpSa.exe,true
RdpSaProxy.exe,true
RdpSaUacHelper.exe,true
rdpshell.exe,true
rdpsign.exe,true
rdrleakdiag.exe,true
RDSPnf.exe,true
ReAgentc.exe,true
recover.exe,true
RecoveryDrive.exe,true
reg.exe,true
regedt32.exe,true
regini.exe,true
Register-CimProvider.exe,true
regsvr32.exe,true
rekeywiz.exe,true
relog.exe,true
RelPost.exe,true
RemotePosWorker.exe,true
replace.exe,true
reset.exe,true
ResetEngine.exe,true
resmon.exe,true
RMActivate.exe,true
RMActivate_isv.exe,true
RMActivate_ssp.exe,true
RMActivate_ssp_isv.exe,true
RmClient.exe,true
rmttpmvscmgrsvr.exe,true
Robocopy.exe,true
ROUTE.EXE,true
RpcPing.exe,true
rrinstaller.exe,true
rsopprov.exe,true
runas.exe,true
rundll32.exe,true
RunLegacyCPLElevated.exe,true
runonce.exe,true
RuntimeBroker.exe,true
rwinsta.exe,true
sacsess.exe,true
sc.exe,true
schtasks.exe,true
ScriptRunner.exe,true
sdbinst.exe,true
sdiagnhost.exe,true
SearchFilterHost.exe,true
SearchIndexer.exe,true
SearchProtocolHost.exe,true
SecEdit.exe,true
secinit.exe,true
securekernel.exe,true
SensorDataService.exe,true
ServerManager.exe,true
ServerManagerLauncher.exe,true
services.exe,true
sessionmsg.exe,true
sethc.exe,true
setres.exe,true
setspn.exe,true
SettingSyncHost.exe,true
setupcl.exe,true
setupugc.exe,true
setx.exe,true
sfc.exe,true
shrpubw.exe,true
shutdown.exe,true
sigverif.exe,true
SIHClient.exe,true
sihost.exe,true
SlideToShutDown.exe,true
slui.exe,true
smartscreen.exe,true
SmartScreenSettings.exe,true
smss.exe,true
SndVol.exe,true
SnippingTool.exe,true
snmptrap.exe,true
sort.exe,true
SpaceAgent.exe,true
spaceman.exe,true
spoolsv.exe,true
SppExtComObj.Exe,true
sppsvc.exe,true
stordiag.exe,true
subst.exe,true
svchost.exe,true
sxstrace.exe,true
SyncAppvPublishingServer.exe,true
SyncHost.exe,true
syskey.exe,true
SysResetErr.exe,true
systeminfo.exe,true
SystemPropertiesAdvanced.exe,true
SystemPropertiesComputerName.exe,true
SystemPropertiesDataExecutionPrevention.exe,true
SystemPropertiesHardware.exe,true
SystemPropertiesPerformance.exe,true
SystemPropertiesProtection.exe,true
SystemPropertiesRemote.exe,true
systemreset.exe,true
SystemSettingsAdminFlows.exe,true
SystemSettingsBroker.exe,true
SystemSettingsRemoveDevice.exe,true
systray.exe,true
tabcal.exe,true
takeown.exe,true
TapiUnattend.exe,true
taskhostw.exe,true
taskkill.exe,true
tasklist.exe,true
Taskmgr.exe,true
tcmsetup.exe,true
TCPSVCS.EXE,true
tdlrecover.exe,true
ThumbnailExtractionHost.exe,true
TieringEngineService.exe,true
timeout.exe,true
TokenBrokerCookies.exe,true
TpmInit.exe,true
tpmvscmgr.exe,true
tpmvscmgrsvr.exe,true
tracerpt.exe,true
TRACERT.EXE,true
tscon.exe,true
tsdiscon.exe,true
tsecimp.exe,true
tskill.exe,true
TSTheme.exe,true
TSWbPrxy.exe,true
typeperf.exe,true
tzsync.exe,true
tzutil.exe,true
ucsvc.exe,true
UevAgentPolicyGenerator.exe,true
UevAppMonitor.exe,true
UevTemplateBaselineGenerator.exe,true
UevTemplateConfigItemGenerator.exe,true
UI0Detect.exe,true
unlodctr.exe,true
unregmp2.exe,true
UpgradeResultsUI.exe,true
upnpcont.exe,true
UserAccountBroker.exe,true
UserAccountControlSettings.exe,true
userinit.exe,true
UsoClient.exe,true
Utilman.exe,true
VaultCmd.exe,true
vds.exe,true
vdsldr.exe,true
verclsid.exe,true
verifier.exe,true
verifiergui.exe,true
vssadmin.exe,true
VSSUIRUN.exe,true
VSSVC.exe,true
w32tm.exe,true
waitfor.exe,true
WallpaperHost.exe,true
WebCache.exe,true
wecutil.exe,true
WerFault.exe,true
WerFaultSecure.exe,true
wermgr.exe,true
wevtutil.exe,true
wextract.exe,true
where.exe,true
whoami.exe,true
wiaacmgr.exe,true
wiawow64.exe,true
wimserv.exe,true
win32calc.exe,true
WinBioDataModelOOBE.exe,true
Windows.Media.BackgroundPlayback.exe,true
WindowsActionDialog.exe,true
WindowsUpdateElevatedInstaller.exe,true
wininit.exe,true
winload.exe,true
winlogon.exe,true
winresume.exe,true
winrs.exe,true
winrshost.exe,true
WinSAT.exe,true
winver.exe,true
wkspbroker.exe,true
wksprt.exe,true
wlrmdr.exe,true
WMPDMC.exe,true
wowreg32.exe,true
WPDShextAutoplay.exe,true
wpr.exe,true
write.exe,true
WSCollect.exe,true
wscript.exe,true
WSManHTTPConfig.exe,true
wsmprovhost.exe,true
wsqmcons.exe,true
WSReset.exe,true
wuapihost.exe,true
wuauclt.exe,true
WUDFHost.exe,true
wusa.exe,true
WWAHost.exe,true
XblGameSaveTask.exe,true
xcopy.exe,true
xwizard.exe,true
comrepl.exe,true
MigRegDB.exe,true
DiagnosticsHub.StandardCollector.Service.exe,true
DismHost.exe,true
F12Chooser.exe,true
IMJPDCT.EXE,true
IMJPSET.EXE,true
IMJPUEX.EXE,true
imjpuexc.exe,true
IMTCLNWZ.EXE,true
IMTCPROP.exe,true
IMCCPHR.exe,true
ImeBroker.exe,true
imecfmui.exe,true
IMEDICTUPDATEUI.EXE,true
IMEPADSV.EXE,true
IMESEARCH.EXE,true
IMEWDBLD.EXE,true
ChsIME.exe,true
ChtIME.exe,true
mighost.exe,true
audit.exe,true
AuditShD.exe,true
FirstLogonAnim.exe,true
msoobe.exe,true
oobeldr.exe,true
Setup.exe,true
UserOOBEBroker.exe,true
windeploy.exe,true
SpeechUXWiz.exe,true
SpeechModelDownload.exe,true
SpeechRuntime.exe,true
PrintBrm.exe,true
PrintBrmEngine.exe,true
sysprep.exe,true
SystemResetPlatform.exe,true
mofcomp.exe,true
scrcons.exe,true
unsecapp.exe,true
wbemtest.exe,true
WinMgmt.exe,true
WMIADAP.exe,true
WmiApSrv.exe,true
WMIC.exe,true
WmiPrvSE.exe,true
powershell.exe,true
powershell_ise.exe,true
dplaysvr.exe,true
dtdump.exe,true
hh.exe,true
instnm.exe,true
perfhost.exe,true
rasautou.exe,true
rasphone.exe,true
regedit.exe,true
setup16.exe,true
user.exe,true
_isdel.exe,true
agentactivationruntimestarter.exe,true
ApplyTrustOffline.exe,true
ApproveChildRequest.exe,true
appverif.exe,true
baaupdate.exe,true
bash.exe,true
bdechangepin.exe,true
BdeHdCfg.exe,true
BdeUISrv.exe,true
bdeunlock.exe,true
BitLockerDeviceEncryption.exe,true
BitLockerWizard.exe,true
BitLockerWizardElev.exe,true
bootsect.exe,true
browserexport.exe,true
CIDiag.exe,true
CompPkgSrv.exe,true
convertvhd.exe,true
coredpussvr.exe,true
CredentialEnrollmentManager.exe,true
curl.exe,true
CustomInstallExec.exe,true
d3dconfig.exe,true
DataStoreCacheDumpTool.exe,true
DataUsageLiveTileTask.exe,true
deploymentcsphelper.exe,true
desktopimgdownldr.exe,true
DeviceCredentialDeployment.exe,true
directxdatabaseupdater.exe,true
dmclient.exe,true
DTUHandler.exe,true
dusmtask.exe,true
DXCap.exe,true
DXCpl.exe,true
dxgiadaptercache.exe,true
EASPolicyManagerBrokerHost.exe,true
EduPrintProv.exe,true
EoAExperiences.exe,true
fhmanagew.exe,true
FileHistory.exe,true
FsIso.exe,true
fvenotify.exe,true
fveprompt.exe,true
FXSCOVER.exe,true
FXSSVC.exe,true
FXSUNATD.exe,true
hcsdiag.exe,true
hnsdiag.exe,true
hvsievaluator.exe,true
ie4ushowIE.exe,true
IESettingSync.exe,true
InputSwitchToastHandler.exe,true
iotstartup.exe,true
manage-bde.exe,true
MBR2GPT.EXE,true
microsoft.windows.softwarelogo.showdesktop.exe,true
MicrosoftEdgeBCHost.exe,true
MicrosoftEdgeCP.exe,true
MicrosoftEdgeDevTools.exe,true
MicrosoftEdgeSH.exe,true
mmgaserver.exe,true
MoUsoCoreWorker.exe,true
msra.exe,true
MusNotifyIcon.exe,true
NDKPing.exe,true
NgcIso.exe,true
nmbind.exe,true
nmscrub.exe,true
nvspinfo.exe,true
ofdeploy.exe,true
pacjsworker.exe,true
PinEnrollmentBroker.exe,true
PktMon.exe,true
pospaymentsworker.exe,true
provlaunch.exe,true
provtool.exe,true
ProximityUxHost.exe,true
prproc.exe,true
quickassist.exe,true
raserver.exe,true
RDVGHelper.exe,true
recdisc.exe,true
refsutil.exe,true
RemoteAppLifetimeManager.exe,true
RemoteFXvGPUDisablement.exe,true
repair-bde.exe,true
rstrui.exe,true
runexehelper.exe,true
sdchange.exe,true
sdclt.exe,true
SecurityHealthHost.exe,true
SecurityHealthService.exe,true
SecurityHealthSystray.exe,true
SgrmBroker.exe,true
SgrmLpac.exe,true
SpatialAudioLicenseSrv.exe,true
Spectrum.exe,true
srdelayed.exe,true
SrTasks.exe,true
SystemUWPLauncher.exe,true
tar.exe,true
tcblaunch.exe,true
TpmTool.exe,true
ttdinject.exe,true
tttracer.exe,true
UIMgrBroker.exe,true
upfc.exe,true
usocoreworker.exe,true
UtcDecoderHost.exe,true
VBoxControl.exe,true
VBoxService.exe,true
VBoxTray.exe,true
vfpctrl.exe,true
vmcompute.exe,true
vmwp.exe,true
VsGraphicsDesktopEngine.exe,true
VsGraphicsRemoteEngine.exe,true
vsjitdebugger.exe,true
WaaSMedicAgent.exe,true
wbadmin.exe,true
wbengine.exe,true
WFS.exe,true
wifitask.exe,true
Windows.WARP.JITService.exe,true
WinRTNetMUAHostServer.exe,true
wlanext.exe,true
WorkFolders.exe,true
WpcMon.exe,true
WpcTok.exe,true
wpnpinst.exe,true
wscadminui.exe,true
wsl.exe,true
wslconfig.exe,true
WUDFCompanionHost.exe,true
IEChooser.exe,true
wslhost.exe,true
scp.exe,true
sftp.exe,true
ssh-add.exe,true
ssh-agent.exe,true
ssh-keygen.exe,true
ssh-keyscan.exe,true
ssh.exe,true
PerceptionSimulationInput.exe,true
PerceptionSimulationService.exe,true
UNPUXHost.exe,true
UNPUXLauncher.exe,true
UpdateNotificationMgr.exe,true
FaceFodUninstaller.exe,true
wlms.exe,true
OneDriveSetup.exe,true
OposHost.exe,true
1 filename systemFile
2 acu.exe true
3 AgentService.exe true
4 aitstatic.exe true
5 alg.exe true
6 AppHostRegistrationVerifier.exe true
7 appidcertstorecheck.exe true
8 appidpolicyconverter.exe true
9 appidtel.exe true
10 ApplicationFrameHost.exe true
11 ApplySettingsTemplateCatalog.exe true
12 AppVClient.exe true
13 AppVDllSurrogate.exe true
14 AppVNice.exe true
15 AppVStreamingUX.exe true
16 ARP.EXE true
17 at.exe true
18 AtBroker.exe true
19 attrib.exe true
20 audiodg.exe true
21 auditpol.exe true
22 AuthHost.exe true
23 autochk.exe true
24 autoconv.exe true
25 autofmt.exe true
26 AxInstUI.exe true
27 backgroundTaskHost.exe true
28 BackgroundTransferHost.exe true
29 bcastdvr.exe true
30 bcdboot.exe true
31 bcdedit.exe true
32 BioIso.exe true
33 bitsadmin.exe true
34 bootcfg.exe true
35 bootim.exe true
36 bridgeunattend.exe true
37 browser_broker.exe true
38 bthudtask.exe true
39 ByteCodeGenerator.exe true
40 cacls.exe true
41 calc.exe true
42 CameraSettingsUIHost.exe true
43 CastSrv.exe true
44 CertEnrollCtrl.exe true
45 certreq.exe true
46 certutil.exe true
47 change.exe true
48 changepk.exe true
49 charmap.exe true
50 CheckNetIsolation.exe true
51 chglogon.exe true
52 chgport.exe true
53 chgusr.exe true
54 chkdsk.exe true
55 chkntfs.exe true
56 choice.exe true
57 cipher.exe true
58 cleanmgr.exe true
59 cliconfg.exe true
60 clip.exe true
61 ClipUp.exe true
62 CloudExperienceHostBroker.exe true
63 CloudNotifications.exe true
64 CloudStorageWizard.exe true
65 cmd.exe true
66 cmdkey.exe true
67 cmdl32.exe true
68 cmmon32.exe true
69 cmstp.exe true
70 cofire.exe true
71 colorcpl.exe true
72 comp.exe true
73 compact.exe true
74 CompatTelRunner.exe true
75 CompMgmtLauncher.exe true
76 ComputerDefaults.exe true
77 Configure-SMRemoting.exe true
78 conhost.exe true
79 consent.exe true
80 control.exe true
81 convert.exe true
82 CredentialUIBroker.exe true
83 credwiz.exe true
84 cscript.exe true
85 csrss.exe true
86 ctfmon.exe true
87 cttune.exe true
88 cttunesvr.exe true
89 dasHost.exe true
90 DataExchangeHost.exe true
91 DataSenseLiveTileTask.exe true
92 dccw.exe true
93 dcgpofix.exe true
94 dcomcnfg.exe true
95 dcpromo.exe true
96 ddodiag.exe true
97 Defrag.exe true
98 DeviceCensus.exe true
99 DeviceEject.exe true
100 DeviceEnroller.exe true
101 DevicePairingWizard.exe true
102 DeviceProperties.exe true
103 DFDWiz.exe true
104 dfrgui.exe true
105 dfsrdiag.exe true
106 dialer.exe true
107 DIMC.exe true
108 diskpart.exe true
109 diskperf.exe true
110 diskraid.exe true
111 diskshadow.exe true
112 DiskSnapshot.exe true
113 Dism.exe true
114 dispdiag.exe true
115 DisplaySwitch.exe true
116 djoin.exe true
117 dllhost.exe true
118 dllhst3g.exe true
119 dmcertinst.exe true
120 dmcfghost.exe true
121 DmNotificationBroker.exe true
122 DmOmaCpMo.exe true
123 dnscacheugc.exe true
124 doskey.exe true
125 dpapimig.exe true
126 DpiScaling.exe true
127 dpnsvr.exe true
128 driverquery.exe true
129 drvcfg.exe true
130 drvinst.exe true
131 DsmUserTask.exe true
132 dsregcmd.exe true
133 dstokenclean.exe true
134 dvdplay.exe true
135 dwm.exe true
136 DWWIN.EXE true
137 dxdiag.exe true
138 Dxpserver.exe true
139 Eap3Host.exe true
140 EaseOfAccessDialog.exe true
141 easinvoker.exe true
142 EasPoliciesBrokerHost.exe true
143 EDPCleanup.exe true
144 edpnotify.exe true
145 efsui.exe true
146 EhStorAuthn.exe true
147 embeddedapplauncher.exe true
148 EmbeddedAppLauncherConfig.exe true
149 escUnattend.exe true
150 esentutl.exe true
151 eudcedit.exe true
152 eventcreate.exe true
153 eventvwr.exe true
154 expand.exe true
155 extrac32.exe true
156 fc.exe true
157 find.exe true
158 findstr.exe true
159 finger.exe true
160 fixmapi.exe true
161 fltMC.exe true
162 fodhelper.exe true
163 Fondue.exe true
164 fontdrvhost.exe true
165 fontview.exe true
166 forfiles.exe true
167 fsavailux.exe true
168 fsquirt.exe true
169 fsutil.exe true
170 ftp.exe true
171 GameBarPresenceWriter.exe true
172 GamePanel.exe true
173 GenValObj.exe true
174 getmac.exe true
175 gpresult.exe true
176 gpscript.exe true
177 gpupdate.exe true
178 grpconv.exe true
179 hdwwiz.exe true
180 help.exe true
181 HOSTNAME.EXE true
182 hvax64.exe true
183 hvix64.exe true
184 hvloader.exe true
185 hwrcomp.exe true
186 hwrreg.exe true
187 iashost.exe true
188 icacls.exe true
189 IcsEntitlementHost.exe true
190 icsunattend.exe true
191 ie4uinit.exe true
192 ieUnatt.exe true
193 iexpress.exe true
194 immersivetpmvscmgrsvr.exe true
195 InfDefaultInstall.exe true
196 InstallAgent.exe true
197 InstallAgentUserBroker.exe true
198 ipconfig.exe true
199 iscsicli.exe true
200 iscsicpl.exe true
201 isoburn.exe true
202 klist.exe true
203 ksetup.exe true
204 ktmutil.exe true
205 ktpass.exe true
206 label.exe true
207 LanguageComponentsInstallerComHandler.exe true
208 LaunchTM.exe true
209 LaunchWinApp.exe true
210 LbfoAdmin.exe true
211 LegacyNetUXHost.exe true
212 LicenseManagerShellext.exe true
213 licensingdiag.exe true
214 LicensingUI.exe true
215 LocationNotificationWindows.exe true
216 Locator.exe true
217 LockAppHost.exe true
218 LockScreenContentServer.exe true
219 lodctr.exe true
220 logagent.exe true
221 logman.exe true
222 logoff.exe true
223 LogonUI.exe true
224 lpkinstall.exe true
225 lpksetup.exe true
226 lpremove.exe true
227 LsaIso.exe true
228 lsass.exe true
229 Magnify.exe true
230 makecab.exe true
231 mavinject.exe true
232 MbaeParserTask.exe true
233 mblctr.exe true
234 mcbuilder.exe true
235 MDEServer.exe true
236 MDMAgent.exe true
237 MDMAppInstaller.exe true
238 MdmDiagnosticsTool.exe true
239 MdRes.exe true
240 MdSched.exe true
241 mfpmp.exe true
242 Microsoft.Uev.CscUnpinTool.exe true
243 Microsoft.Uev.SyncController.exe true
244 mmc.exe true
245 mobsync.exe true
246 mountvol.exe true
247 mpnotify.exe true
248 MpSigStub.exe true
249 MRINFO.EXE true
250 MRT-KB890830.exe true
251 MRT.exe true
252 MSchedExe.exe true
253 msconfig.exe true
254 msdt.exe true
255 msdtc.exe true
256 msfeedssync.exe true
257 msg.exe true
258 mshta.exe true
259 msiexec.exe true
260 msinfo32.exe true
261 mspaint.exe true
262 MsSpellCheckingHost.exe true
263 mstsc.exe true
264 mtstocom.exe true
265 MuiUnattend.exe true
266 MultiDigiMon.exe true
267 MusNotification.exe true
268 MusNotificationUx.exe true
269 Narrator.exe true
270 nbtstat.exe true
271 ndadmin.exe true
272 net.exe true
273 net1.exe true
274 netbtugc.exe true
275 netcfg.exe true
276 NetCfgNotifyObjectHost.exe true
277 netdom.exe true
278 NetEvtFwdr.exe true
279 NetHost.exe true
280 netiougc.exe true
281 Netplwiz.exe true
282 netsh.exe true
283 NETSTAT.EXE true
284 newdev.exe true
285 nltest.exe true
286 notepad.exe true
287 nslookup.exe true
288 ntoskrnl.exe true
289 ntprint.exe true
290 odbcad32.exe true
291 odbcconf.exe true
292 omadmclient.exe true
293 omadmprc.exe true
294 openfiles.exe true
295 OpenWith.exe true
296 OptionalFeatures.exe true
297 osk.exe true
298 PackagedCWALauncher.exe true
299 PackageInspector.exe true
300 PasswordOnWakeSettingFlyout.exe true
301 PATHPING.EXE true
302 pcalua.exe true
303 pcaui.exe true
304 pcwrun.exe true
305 perfmon.exe true
306 phoneactivate.exe true
307 PickerHost.exe true
308 PING.EXE true
309 PkgMgr.exe true
310 plasrv.exe true
311 PnPUnattend.exe true
312 pnputil.exe true
313 poqexec.exe true
314 powercfg.exe true
315 PresentationHost.exe true
316 PresentationSettings.exe true
317 prevhost.exe true
318 print.exe true
319 PrintBrmUi.exe true
320 PrintDialogHost.exe true
321 PrintDialogHost3D.exe true
322 printfilterpipelinesvc.exe true
323 PrintIsolationHost.exe true
324 printui.exe true
325 proquota.exe true
326 psr.exe true
327 pwlauncher.exe true
328 qappsrv.exe true
329 qprocess.exe true
330 query.exe true
331 quser.exe true
332 qwinsta.exe true
333 rasdial.exe true
334 rdpclip.exe true
335 rdpinit.exe true
336 rdpinput.exe true
337 RdpSa.exe true
338 RdpSaProxy.exe true
339 RdpSaUacHelper.exe true
340 rdpshell.exe true
341 rdpsign.exe true
342 rdrleakdiag.exe true
343 RDSPnf.exe true
344 ReAgentc.exe true
345 recover.exe true
346 RecoveryDrive.exe true
347 reg.exe true
348 regedt32.exe true
349 regini.exe true
350 Register-CimProvider.exe true
351 regsvr32.exe true
352 rekeywiz.exe true
353 relog.exe true
354 RelPost.exe true
355 RemotePosWorker.exe true
356 replace.exe true
357 reset.exe true
358 ResetEngine.exe true
359 resmon.exe true
360 RMActivate.exe true
361 RMActivate_isv.exe true
362 RMActivate_ssp.exe true
363 RMActivate_ssp_isv.exe true
364 RmClient.exe true
365 rmttpmvscmgrsvr.exe true
366 Robocopy.exe true
367 ROUTE.EXE true
368 RpcPing.exe true
369 rrinstaller.exe true
370 rsopprov.exe true
371 runas.exe true
372 rundll32.exe true
373 RunLegacyCPLElevated.exe true
374 runonce.exe true
375 RuntimeBroker.exe true
376 rwinsta.exe true
377 sacsess.exe true
378 sc.exe true
379 schtasks.exe true
380 ScriptRunner.exe true
381 sdbinst.exe true
382 sdiagnhost.exe true
383 SearchFilterHost.exe true
384 SearchIndexer.exe true
385 SearchProtocolHost.exe true
386 SecEdit.exe true
387 secinit.exe true
388 securekernel.exe true
389 SensorDataService.exe true
390 ServerManager.exe true
391 ServerManagerLauncher.exe true
392 services.exe true
393 sessionmsg.exe true
394 sethc.exe true
395 setres.exe true
396 setspn.exe true
397 SettingSyncHost.exe true
398 setupcl.exe true
399 setupugc.exe true
400 setx.exe true
401 sfc.exe true
402 shrpubw.exe true
403 shutdown.exe true
404 sigverif.exe true
405 SIHClient.exe true
406 sihost.exe true
407 SlideToShutDown.exe true
408 slui.exe true
409 smartscreen.exe true
410 SmartScreenSettings.exe true
411 smss.exe true
412 SndVol.exe true
413 SnippingTool.exe true
414 snmptrap.exe true
415 sort.exe true
416 SpaceAgent.exe true
417 spaceman.exe true
418 spoolsv.exe true
419 SppExtComObj.Exe true
420 sppsvc.exe true
421 stordiag.exe true
422 subst.exe true
423 svchost.exe true
424 sxstrace.exe true
425 SyncAppvPublishingServer.exe true
426 SyncHost.exe true
427 syskey.exe true
428 SysResetErr.exe true
429 systeminfo.exe true
430 SystemPropertiesAdvanced.exe true
431 SystemPropertiesComputerName.exe true
432 SystemPropertiesDataExecutionPrevention.exe true
433 SystemPropertiesHardware.exe true
434 SystemPropertiesPerformance.exe true
435 SystemPropertiesProtection.exe true
436 SystemPropertiesRemote.exe true
437 systemreset.exe true
438 SystemSettingsAdminFlows.exe true
439 SystemSettingsBroker.exe true
440 SystemSettingsRemoveDevice.exe true
441 systray.exe true
442 tabcal.exe true
443 takeown.exe true
444 TapiUnattend.exe true
445 taskhostw.exe true
446 taskkill.exe true
447 tasklist.exe true
448 Taskmgr.exe true
449 tcmsetup.exe true
450 TCPSVCS.EXE true
451 tdlrecover.exe true
452 ThumbnailExtractionHost.exe true
453 TieringEngineService.exe true
454 timeout.exe true
455 TokenBrokerCookies.exe true
456 TpmInit.exe true
457 tpmvscmgr.exe true
458 tpmvscmgrsvr.exe true
459 tracerpt.exe true
460 TRACERT.EXE true
461 tscon.exe true
462 tsdiscon.exe true
463 tsecimp.exe true
464 tskill.exe true
465 TSTheme.exe true
466 TSWbPrxy.exe true
467 typeperf.exe true
468 tzsync.exe true
469 tzutil.exe true
470 ucsvc.exe true
471 UevAgentPolicyGenerator.exe true
472 UevAppMonitor.exe true
473 UevTemplateBaselineGenerator.exe true
474 UevTemplateConfigItemGenerator.exe true
475 UI0Detect.exe true
476 unlodctr.exe true
477 unregmp2.exe true
478 UpgradeResultsUI.exe true
479 upnpcont.exe true
480 UserAccountBroker.exe true
481 UserAccountControlSettings.exe true
482 userinit.exe true
483 UsoClient.exe true
484 Utilman.exe true
485 VaultCmd.exe true
486 vds.exe true
487 vdsldr.exe true
488 verclsid.exe true
489 verifier.exe true
490 verifiergui.exe true
491 vssadmin.exe true
492 VSSUIRUN.exe true
493 VSSVC.exe true
494 w32tm.exe true
495 waitfor.exe true
496 WallpaperHost.exe true
497 WebCache.exe true
498 wecutil.exe true
499 WerFault.exe true
500 WerFaultSecure.exe true
501 wermgr.exe true
502 wevtutil.exe true
503 wextract.exe true
504 where.exe true
505 whoami.exe true
506 wiaacmgr.exe true
507 wiawow64.exe true
508 wimserv.exe true
509 win32calc.exe true
510 WinBioDataModelOOBE.exe true
511 Windows.Media.BackgroundPlayback.exe true
512 WindowsActionDialog.exe true
513 WindowsUpdateElevatedInstaller.exe true
514 wininit.exe true
515 winload.exe true
516 winlogon.exe true
517 winresume.exe true
518 winrs.exe true
519 winrshost.exe true
520 WinSAT.exe true
521 winver.exe true
522 wkspbroker.exe true
523 wksprt.exe true
524 wlrmdr.exe true
525 WMPDMC.exe true
526 wowreg32.exe true
527 WPDShextAutoplay.exe true
528 wpr.exe true
529 write.exe true
530 WSCollect.exe true
531 wscript.exe true
532 WSManHTTPConfig.exe true
533 wsmprovhost.exe true
534 wsqmcons.exe true
535 WSReset.exe true
536 wuapihost.exe true
537 wuauclt.exe true
538 WUDFHost.exe true
539 wusa.exe true
540 WWAHost.exe true
541 XblGameSaveTask.exe true
542 xcopy.exe true
543 xwizard.exe true
544 comrepl.exe true
545 MigRegDB.exe true
546 DiagnosticsHub.StandardCollector.Service.exe true
547 DismHost.exe true
548 F12Chooser.exe true
549 IMJPDCT.EXE true
550 IMJPSET.EXE true
551 IMJPUEX.EXE true
552 imjpuexc.exe true
553 IMTCLNWZ.EXE true
554 IMTCPROP.exe true
555 IMCCPHR.exe true
556 ImeBroker.exe true
557 imecfmui.exe true
558 IMEDICTUPDATEUI.EXE true
559 IMEPADSV.EXE true
560 IMESEARCH.EXE true
561 IMEWDBLD.EXE true
562 ChsIME.exe true
563 ChtIME.exe true
564 mighost.exe true
565 audit.exe true
566 AuditShD.exe true
567 FirstLogonAnim.exe true
568 msoobe.exe true
569 oobeldr.exe true
570 Setup.exe true
571 UserOOBEBroker.exe true
572 windeploy.exe true
573 SpeechUXWiz.exe true
574 SpeechModelDownload.exe true
575 SpeechRuntime.exe true
576 PrintBrm.exe true
577 PrintBrmEngine.exe true
578 sysprep.exe true
579 SystemResetPlatform.exe true
580 mofcomp.exe true
581 scrcons.exe true
582 unsecapp.exe true
583 wbemtest.exe true
584 WinMgmt.exe true
585 WMIADAP.exe true
586 WmiApSrv.exe true
587 WMIC.exe true
588 WmiPrvSE.exe true
589 powershell.exe true
590 powershell_ise.exe true
591 dplaysvr.exe true
592 dtdump.exe true
593 hh.exe true
594 instnm.exe true
595 perfhost.exe true
596 rasautou.exe true
597 rasphone.exe true
598 regedit.exe true
599 setup16.exe true
600 user.exe true
601 _isdel.exe true
602 agentactivationruntimestarter.exe true
603 ApplyTrustOffline.exe true
604 ApproveChildRequest.exe true
605 appverif.exe true
606 baaupdate.exe true
607 bash.exe true
608 bdechangepin.exe true
609 BdeHdCfg.exe true
610 BdeUISrv.exe true
611 bdeunlock.exe true
612 BitLockerDeviceEncryption.exe true
613 BitLockerWizard.exe true
614 BitLockerWizardElev.exe true
615 bootsect.exe true
616 browserexport.exe true
617 CIDiag.exe true
618 CompPkgSrv.exe true
619 convertvhd.exe true
620 coredpussvr.exe true
621 CredentialEnrollmentManager.exe true
622 curl.exe true
623 CustomInstallExec.exe true
624 d3dconfig.exe true
625 DataStoreCacheDumpTool.exe true
626 DataUsageLiveTileTask.exe true
627 deploymentcsphelper.exe true
628 desktopimgdownldr.exe true
629 DeviceCredentialDeployment.exe true
630 directxdatabaseupdater.exe true
631 dmclient.exe true
632 DTUHandler.exe true
633 dusmtask.exe true
634 DXCap.exe true
635 DXCpl.exe true
636 dxgiadaptercache.exe true
637 EASPolicyManagerBrokerHost.exe true
638 EduPrintProv.exe true
639 EoAExperiences.exe true
640 fhmanagew.exe true
641 FileHistory.exe true
642 FsIso.exe true
643 fvenotify.exe true
644 fveprompt.exe true
645 FXSCOVER.exe true
646 FXSSVC.exe true
647 FXSUNATD.exe true
648 hcsdiag.exe true
649 hnsdiag.exe true
650 hvsievaluator.exe true
651 ie4ushowIE.exe true
652 IESettingSync.exe true
653 InputSwitchToastHandler.exe true
654 iotstartup.exe true
655 manage-bde.exe true
656 MBR2GPT.EXE true
657 microsoft.windows.softwarelogo.showdesktop.exe true
658 MicrosoftEdgeBCHost.exe true
659 MicrosoftEdgeCP.exe true
660 MicrosoftEdgeDevTools.exe true
661 MicrosoftEdgeSH.exe true
662 mmgaserver.exe true
663 MoUsoCoreWorker.exe true
664 msra.exe true
665 MusNotifyIcon.exe true
666 NDKPing.exe true
667 NgcIso.exe true
668 nmbind.exe true
669 nmscrub.exe true
670 nvspinfo.exe true
671 ofdeploy.exe true
672 pacjsworker.exe true
673 PinEnrollmentBroker.exe true
674 PktMon.exe true
675 pospaymentsworker.exe true
676 provlaunch.exe true
677 provtool.exe true
678 ProximityUxHost.exe true
679 prproc.exe true
680 quickassist.exe true
681 raserver.exe true
682 RDVGHelper.exe true
683 recdisc.exe true
684 refsutil.exe true
685 RemoteAppLifetimeManager.exe true
686 RemoteFXvGPUDisablement.exe true
687 repair-bde.exe true
688 rstrui.exe true
689 runexehelper.exe true
690 sdchange.exe true
691 sdclt.exe true
692 SecurityHealthHost.exe true
693 SecurityHealthService.exe true
694 SecurityHealthSystray.exe true
695 SgrmBroker.exe true
696 SgrmLpac.exe true
697 SpatialAudioLicenseSrv.exe true
698 Spectrum.exe true
699 srdelayed.exe true
700 SrTasks.exe true
701 SystemUWPLauncher.exe true
702 tar.exe true
703 tcblaunch.exe true
704 TpmTool.exe true
705 ttdinject.exe true
706 tttracer.exe true
707 UIMgrBroker.exe true
708 upfc.exe true
709 usocoreworker.exe true
710 UtcDecoderHost.exe true
711 VBoxControl.exe true
712 VBoxService.exe true
713 VBoxTray.exe true
714 vfpctrl.exe true
715 vmcompute.exe true
716 vmwp.exe true
717 VsGraphicsDesktopEngine.exe true
718 VsGraphicsRemoteEngine.exe true
719 vsjitdebugger.exe true
720 WaaSMedicAgent.exe true
721 wbadmin.exe true
722 wbengine.exe true
723 WFS.exe true
724 wifitask.exe true
725 Windows.WARP.JITService.exe true
726 WinRTNetMUAHostServer.exe true
727 wlanext.exe true
728 WorkFolders.exe true
729 WpcMon.exe true
730 WpcTok.exe true
731 wpnpinst.exe true
732 wscadminui.exe true
733 wsl.exe true
734 wslconfig.exe true
735 WUDFCompanionHost.exe true
736 IEChooser.exe true
737 wslhost.exe true
738 scp.exe true
739 sftp.exe true
740 ssh-add.exe true
741 ssh-agent.exe true
742 ssh-keygen.exe true
743 ssh-keyscan.exe true
744 ssh.exe true
745 PerceptionSimulationInput.exe true
746 PerceptionSimulationService.exe true
747 UNPUXHost.exe true
748 UNPUXLauncher.exe true
749 UpdateNotificationMgr.exe true
750 FaceFodUninstaller.exe true
751 wlms.exe true
752 OneDriveSetup.exe true
753 OposHost.exe true
dist/devsecops/lookups/legit_domains.csv
Vendored
+20
View File
@@ -0,0 +1,20 @@
domain, isLegit
amazon.com, True
ssl-images-amazon.com, True
facebook.com, True
xx.fbcdn.net, True
github.com, True
githubassets.com, True
instagram.com, True
linkedin.com, True
microsoftonline.com, True
office.com, True
okta.com, True
live.com, True
protonmail.com, True
reddit.com, True
redditstatic.com, True
twitter.com, True
twimg.com, True
google.com, True
1 domain isLegit
2 amazon.com True
3 ssl-images-amazon.com True
4 facebook.com True
5 xx.fbcdn.net True
6 github.com True
7 githubassets.com True
8 instagram.com True
9 linkedin.com True
10 microsoftonline.com True
11 office.com True
12 okta.com True
13 live.com True
14 protonmail.com True
15 reddit.com True
16 redditstatic.com True
17 twitter.com True
18 twimg.com True
19 google.com True
dist/devsecops/lookups/local_file_inclusion_paths.csv
Vendored
+1009
View File
File diff suppressed because it is too large Load Diff
dist/devsecops/lookups/mitre_enrichment.csv
Vendored
+564
View File
@@ -0,0 +1,564 @@
"mitre_id","technique","tactics","groups"
"T1553.006","Code Signing Policy Modification","Defense Evasion","Turla|APT39"
"T1614","System Location Discovery","Discovery","no"
"T1613","Container and Resource Discovery","Discovery","no"
"T1552.007","Container API","Credential Access","no"
"T1612","Build Image on Host","Defense Evasion","no"
"T1611","Escape to Host","Privilege Escalation","no"
"T1204.003","Malicious Image","Execution","no"
"T1053.007","Container Orchestration Job","Execution|Persistence|Privilege Escalation","no"
"T1610","Deploy Container","Defense Evasion|Execution","no"
"T1609","Container Administration Command","Execution","no"
"T1608.005","Link Target","Resource Development","Silent Librarian"
"T1608.004","Drive-by Target","Resource Development","APT32|Threat Group-3390"
"T1608.003","Install Digital Certificate","Resource Development","no"
"T1608.002","Upload Tool","Resource Development","Threat Group-3390"
"T1608.001","Upload Malware","Resource Development","APT32"
"T1608","Stage Capabilities","Resource Development","no"
"T1016.001","Internet Connection Discovery","Discovery","APT29|UNC2452|Turla"
"T1553.005","Mark-of-the-Web Bypass","Defense Evasion","TA505"
"T1555.005","Password Managers","Credential Access","Fox Kitten|Operation Wocao"
"T1484.002","Domain Trust Modification","Defense Evasion|Privilege Escalation","APT29|UNC2452"
"T1484.001","Group Policy Modification","Defense Evasion|Privilege Escalation","Indrik Spider"
"T1547.014","Active Setup","Persistence|Privilege Escalation","no"
"T1606.002","SAML Tokens","Credential Access","APT29|UNC2452"
"T1606.001","Web Cookies","Credential Access","APT29|UNC2452"
"T1606","Forge Web Credentials","Credential Access","no"
"T1555.004","Windows Credential Manager","Credential Access","Stealth Falcon|OilRig|Turla"
"T1059.008","Network Device CLI","Execution","no"
"T1602.002","Network Device Configuration Dump","Collection","no"
"T1542.005","TFTP Boot","Defense Evasion|Persistence","no"
"T1542.004","ROMMONkit","Defense Evasion|Persistence","no"
"T1602.001","SNMP (MIB Dump)","Collection","no"
"T1602","Data from Configuration Repository","Collection","no"
"T1601.002","Downgrade System Image","Defense Evasion","no"
"T1601.001","Patch System Image","Defense Evasion","no"
"T1601","Modify System Image","Defense Evasion","no"
"T1600.002","Disable Crypto Hardware","Defense Evasion","no"
"T1600.001","Reduce Key Space","Defense Evasion","no"
"T1600","Weaken Encryption","Defense Evasion","no"
"T1556.004","Network Device Authentication","Credential Access|Defense Evasion|Persistence","no"
"T1599.001","Network Address Translation Traversal","Defense Evasion","no"
"T1599","Network Boundary Bridging","Defense Evasion","no"
"T1020.001","Traffic Duplication","Exfiltration","no"
"T1557.002","ARP Cache Poisoning","Credential Access|Collection","Cleaver"
"T1588.006","Vulnerabilities","Resource Development","Sandworm Team"
"T1053.006","Systemd Timers","Execution|Persistence|Privilege Escalation","no"
"T1562.008","Disable Cloud Logs","Defense Evasion","no"
"T1547.012","Print Processors","Persistence|Privilege Escalation","no"
"T1598.003","Spearphishing Link","Reconnaissance","Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky"
"T1598.002","Spearphishing Attachment","Reconnaissance","Sidewinder"
"T1598.001","Spearphishing Service","Reconnaissance","no"
"T1598","Phishing for Information","Reconnaissance","ZIRCONIUM|APT28"
"T1597.002","Purchase Technical Data","Reconnaissance","no"
"T1597.001","Threat Intel Vendors","Reconnaissance","no"
"T1597","Search Closed Sources","Reconnaissance","no"
"T1596.005","Scan Databases","Reconnaissance","no"
"T1596.004","CDNs","Reconnaissance","no"
"T1596.003","Digital Certificates","Reconnaissance","no"
"T1596.001","DNS/Passive DNS","Reconnaissance","no"
"T1596.002","WHOIS","Reconnaissance","no"
"T1596","Search Open Technical Databases","Reconnaissance","no"
"T1595.002","Vulnerability Scanning","Reconnaissance","Volatile Cedar|APT28|Sandworm Team"
"T1595.001","Scanning IP Blocks","Reconnaissance","no"
"T1595","Active Scanning","Reconnaissance","no"
"T1594","Search Victim-Owned Websites","Reconnaissance","Silent Librarian|Sandworm Team"
"T1593.002","Search Engines","Reconnaissance","no"
"T1593.001","Social Media","Reconnaissance","no"
"T1593","Search Open Websites/Domains","Reconnaissance","Sandworm Team"
"T1592.004","Client Configurations","Reconnaissance","HAFNIUM"
"T1592.003","Firmware","Reconnaissance","no"
"T1592.002","Software","Reconnaissance","Sandworm Team"
"T1592.001","Hardware","Reconnaissance","no"
"T1592","Gather Victim Host Information","Reconnaissance","no"
"T1591.004","Identify Roles","Reconnaissance","no"
"T1591.003","Identify Business Tempo","Reconnaissance","no"
"T1591.001","Determine Physical Locations","Reconnaissance","no"
"T1591.002","Business Relationships","Reconnaissance","Sandworm Team"
"T1591","Gather Victim Org Information","Reconnaissance","no"
"T1590.006","Network Security Appliances","Reconnaissance","no"
"T1590.005","IP Addresses","Reconnaissance","HAFNIUM"
"T1590.004","Network Topology","Reconnaissance","no"
"T1590.003","Network Trust Dependencies","Reconnaissance","no"
"T1590.002","DNS","Reconnaissance","no"
"T1590.001","Domain Properties","Reconnaissance","Sandworm Team"
"T1590","Gather Victim Network Information","Reconnaissance","HAFNIUM"
"T1589.003","Employee Names","Reconnaissance","Silent Librarian|Sandworm Team"
"T1589.002","Email Addresses","Reconnaissance","TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team"
"T1589.001","Credentials","Reconnaissance","APT28|Magic Hound|Chimera"
"T1589","Gather Victim Identity Information","Reconnaissance","APT32"
"T1588.005","Exploits","Resource Development","no"
"T1588.004","Digital Certificates","Resource Development","Lazarus Group|Silent Librarian"
"T1588.003","Code Signing Certificates","Resource Development","Wizard Spider"
"T1588.002","Tool","Resource Development","MuddyWater|Silent Librarian|GALLIUM|Sandworm Team"
"T1588.001","Malware","Resource Development","Turla|APT1"
"T1588","Obtain Capabilities","Resource Development","no"
"T1587.004","Exploits","Resource Development","no"
"T1587.003","Digital Certificates","Resource Development","APT29|PROMETHIUM"
"T1587.002","Code Signing Certificates","Resource Development","PROMETHIUM|Patchwork"
"T1587.001","Malware","Resource Development","APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver"
"T1587","Develop Capabilities","Resource Development","Kimsuky"
"T1586.002","Email Accounts","Resource Development","Magic Hound|Kimsuky"
"T1586.001","Social Media Accounts","Resource Development","no"
"T1586","Compromise Accounts","Resource Development","no"
"T1585.002","Email Accounts","Resource Development","Magic Hound|Silent Librarian|Sandworm Team|APT1"
"T1585.001","Social Media Accounts","Resource Development","Fox Kitten|Sandworm Team|APT32|Cleaver"
"T1585","Establish Accounts","Resource Development","Fox Kitten|APT17"
"T1584.006","Web Services","Resource Development","Turla"
"T1584.005","Botnet","Resource Development","no"
"T1584.004","Server","Resource Development","Indrik Spider|Turla|APT16"
"T1584.003","Virtual Private Server","Resource Development","Turla"
"T1584.002","DNS Server","Resource Development","no"
"T1584.001","Domains","Resource Development","APT29|UNC2452|APT1"
"T1583.006","Web Services","Resource Development","ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29"
"T1583.005","Botnet","Resource Development","no"
"T1583.004","Server","Resource Development","GALLIUM|Sandworm Team"
"T1583.003","Virtual Private Server","Resource Development","HAFNIUM|TEMP.Veles"
"T1583.002","DNS Server","Resource Development","no"
"T1584","Compromise Infrastructure","Resource Development","no"
"T1583.001","Domains","Resource Development","APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28"
"T1583","Acquire Infrastructure","Resource Development","no"
"T1564.007","VBA Stomping","Defense Evasion","no"
"T1558.004","AS-REP Roasting","Credential Access","no"
"T1580","Cloud Infrastructure Discovery","Discovery","no"
"T1218.012","Verclsid","Defense Evasion","no"
"T1205.001","Port Knocking","Defense Evasion|Persistence|Command And Control","PROMETHIUM"
"T1564.006","Run Virtual Instance","Defense Evasion","no"
"T1564.005","Hidden File System","Defense Evasion","Strider|Equation"
"T1556.003","Pluggable Authentication Modules","Credential Access|Defense Evasion|Persistence","no"
"T1574.012","COR_PROFILER","Persistence|Privilege Escalation|Defense Evasion","Blue Mockingbird"
"T1562.007","Disable or Modify Cloud Firewall","Defense Evasion","no"
"T1098.004","SSH Authorized Keys","Persistence","no"
"T1480.001","Environmental Keying","Defense Evasion","APT41|Equation"
"T1059.007","JavaScript","Execution","MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer"
"T1578.004","Revert Cloud Instance","Defense Evasion","no"
"T1578.003","Delete Cloud Instance","Defense Evasion","no"
"T1578.001","Create Snapshot","Defense Evasion","no"
"T1578.002","Create Cloud Instance","Defense Evasion","no"
"T1127.001","MSBuild","Defense Evasion","Frankenstein"
"T1027.005","Indicator Removal from Tools","Defense Evasion","Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda"
"T1562.006","Indicator Blocking","Defense Evasion","no"
"T1573.002","Asymmetric Cryptography","Command And Control","Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6"
"T1573.001","Symmetric Cryptography","Command And Control","Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group"
"T1573","Encrypted Channel","Command And Control","Tropic Trooper"
"T1027.004","Compile After Delivery","Defense Evasion","Gamaredon Group|Rocke|MuddyWater"
"T1574.004","Dylib Hijacking","Persistence|Privilege Escalation|Defense Evasion","no"
"T1546.015","Component Object Model Hijacking","Privilege Escalation|Persistence","APT28"
"T1071.004","DNS","Command And Control","Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7"
"T1071.003","Mail Protocols","Command And Control","Turla|Kimsuky|APT32|SilverTerrier|APT28"
"T1071.002","File Transfer Protocols","Command And Control","Kimsuky|APT41|SilverTerrier|Honeybee"
"T1071.001","Web Protocols","Command And Control","APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon"
"T1572","Protocol Tunneling","Command And Control","Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6"
"T1048.003","Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","Exfiltration","Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group"
"T1048.002","Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","Exfiltration","APT29|UNC2452"
"T1048.001","Exfiltration Over Symmetric Encrypted Non-C2 Protocol","Exfiltration","no"
"T1001.003","Protocol Impersonation","Command And Control","Higaisa|Lazarus Group"
"T1001.002","Steganography","Command And Control","APT29|Axiom"
"T1001.001","Junk Data","Command And Control","APT28"
"T1132.002","Non-Standard Encoding","Command And Control","no"
"T1132.001","Standard Encoding","Command And Control","HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork"
"T1090.004","Domain Fronting","Command And Control","APT29"
"T1090.003","Multi-hop Proxy","Command And Control","APT28|Operation Wocao|Inception|FIN4|APT29"
"T1090.002","External Proxy","Command And Control","APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28"
"T1090.001","Internal Proxy","Command And Control","APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider"
"T1102.003","One-Way Communication","Command And Control","Leviathan"
"T1102.002","Bidirectional Communication","Command And Control","ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak"
"T1102.001","Dead Drop Resolver","Command And Control","Rocke|APT41|BRONZE BUTLER|RTM|Patchwork"
"T1571","Non-Standard Port","Command And Control","Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7"
"T1074.002","Remote Data Staging","Collection","APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8"
"T1074.001","Local Data Staging","Collection","Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28"
"T1078.004","Cloud Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT33"
"T1564.004","NTFS File Attributes","Defense Evasion","APT32"
"T1564.003","Hidden Window","Defense Evasion","Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound"
"T1078.003","Local Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32"
"T1078.002","Domain Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314"
"T1078.001","Default Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","no"
"T1564.002","Hidden Users","Defense Evasion","no"
"T1574.006","Dynamic Linker Hijacking","Persistence|Privilege Escalation|Defense Evasion","APT41|Rocke"
"T1574.002","DLL Side-Loading","Persistence|Privilege Escalation|Defense Evasion","Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390"
"T1574.001","DLL Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass"
"T1574.008","Path Interception by Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574.007","Path Interception by PATH Environment Variable","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574.009","Path Interception by Unquoted Path","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574.011","Services Registry Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574.005","Executable Installer File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574.010","Services File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
"T1574","Hijack Execution Flow","Persistence|Privilege Escalation|Defense Evasion","no"
"T1069.001","Local Groups","Discovery","Chimera|Operation Wocao|Turla|OilRig|admin@338"
"T1570","Lateral Tool Transfer","Lateral Movement","Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10"
"T1568.003","DNS Calculation","Command And Control","APT12"
"T1204.002","Malicious File","Execution","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan"
"T1204.001","Malicious Link","Execution","APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla"
"T1195.003","Compromise Hardware Supply Chain","Initial Access","no"
"T1195.002","Compromise Software Supply Chain","Initial Access","APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41"
"T1195.001","Compromise Software Dependencies and Development Tools","Initial Access","no"
"T1568.001","Fast Flux DNS","Command And Control","menuPass|TA505"
"T1052.001","Exfiltration over USB","Exfiltration","Mustang Panda|Tropic Trooper"
"T1569.002","Service Execution","Execution","Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang"
"T1569.001","Launchctl","Execution","no"
"T1569","System Services","Execution","no"
"T1568.002","Domain Generation Algorithms","Command And Control","TA551|APT41"
"T1568","Dynamic Resolution","Command And Control","APT29|UNC2452"
"T1011.001","Exfiltration Over Bluetooth","Exfiltration","no"
"T1567.002","Exfiltration to Cloud Storage","Exfiltration","ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla"
"T1567.001","Exfiltration to Code Repository","Exfiltration","no"
"T1059.006","Python","Execution","ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete"
"T1059.005","Visual Basic","Execution","Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound"
"T1059.004","Unix Shell","Execution","Rocke|APT41"
"T1059.003","Windows Command Shell","Execution","APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1"
"T1059.002","AppleScript","Execution","no"
"T1059.001","PowerShell","Execution","Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda"
"T1567","Exfiltration Over Web Service","Exfiltration","APT28"
"T1497.003","Time Based Evasion","Defense Evasion|Discovery","no"
"T1497.002","User Activity Based Checks","Defense Evasion|Discovery","Darkhotel|FIN7"
"T1497.001","System Checks","Defense Evasion|Discovery","Darkhotel|Evilnum|Frankenstein"
"T1498.002","Reflection Amplification","Impact","no"
"T1498.001","Direct Network Flood","Impact","no"
"T1566.003","Spearphishing via Service","Initial Access","Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal"
"T1566.002","Spearphishing Link","Initial Access","Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound"
"T1566.001","Spearphishing Attachment","Initial Access","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM"
"T1566","Phishing","Initial Access","GOLD SOUTHFIELD|Dragonfly"
"T1565.003","Runtime Data Manipulation","Impact","APT38"
"T1565.002","Transmitted Data Manipulation","Impact","APT38"
"T1565.001","Stored Data Manipulation","Impact","FIN4|APT38"
"T1565","Data Manipulation","Impact","no"
"T1564.001","Hidden Files and Directories","Defense Evasion","Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28"
"T1564","Hide Artifacts","Defense Evasion","no"
"T1563.002","RDP Hijacking","Lateral Movement","no"
"T1563.001","SSH Hijacking","Lateral Movement","no"
"T1563","Remote Service Session Hijacking","Lateral Movement","no"
"T1518.001","Security Software Discovery","Discovery","Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon"
"T1069.003","Cloud Groups","Discovery","no"
"T1069.002","Domain Groups","Discovery","Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang"
"T1087.004","Cloud Account","Discovery","no"
"T1087.003","Email Account","Discovery","Sandworm Team|TA505"
"T1087.002","Domain Account","Discovery","MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang"
"T1087.001","Local Account","Discovery","Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338"
"T1553.004","Install Root Certificate","Defense Evasion","no"
"T1562.004","Disable or Modify System Firewall","Defense Evasion","APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak"
"T1562.003","Impair Command History Logging","Defense Evasion","no"
"T1562.002","Disable Windows Event Logging","Defense Evasion","APT29|UNC2452|Threat Group-3390"
"T1562.001","Disable or Modify Tools","Defense Evasion","APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda"
"T1562","Impair Defenses","Defense Evasion","no"
"T1003.004","LSA Secrets","Credential Access","OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390"
"T1003.005","Cached Domain Credentials","Credential Access","OilRig|MuddyWater|Leafminer|APT33"
"T1561.002","Disk Structure Wipe","Impact","Sandworm Team|Lazarus Group|APT38|APT37"
"T1561.001","Disk Content Wipe","Impact","Lazarus Group"
"T1561","Disk Wipe","Impact","no"
"T1560.003","Archive via Custom Method","Collection","Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6"
"T1560.002","Archive via Library","Collection","Lazarus Group|Threat Group-3390"
"T1560.001","Archive via Utility","Collection","APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang"
"T1560","Archive Collected Data","Collection","menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang"
"T1499.004","Application or System Exploitation","Impact","no"
"T1499.003","Application Exhaustion Flood","Impact","no"
"T1499.002","Service Exhaustion Flood","Impact","no"
"T1499.001","OS Exhaustion Flood","Impact","no"
"T1491.002","External Defacement","Impact","Sandworm Team"
"T1491.001","Internal Defacement","Impact","Lazarus Group"
"T1114.003","Email Forwarding Rule","Collection","Silent Librarian|Kimsuky"
"T1114.002","Remote Email Collection","Collection","APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang"
"T1114.001","Local Email Collection","Collection","Chimera|Magic Hound|APT1"
"T1134.005","SID-History Injection","Defense Evasion|Privilege Escalation","no"
"T1134.004","Parent PID Spoofing","Defense Evasion|Privilege Escalation","no"
"T1134.003","Make and Impersonate Token","Defense Evasion|Privilege Escalation","no"
"T1134.002","Create Process with Token","Defense Evasion|Privilege Escalation","Turla|Lazarus Group"
"T1134.001","Token Impersonation/Theft","Defense Evasion|Privilege Escalation","APT28"
"T1213.002","Sharepoint","Collection","Chimera|Ke3chang|APT28"
"T1213.001","Confluence","Collection","no"
"T1555.003","Credentials from Web Browsers","Credential Access","Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats"
"T1555.002","Securityd Memory","Credential Access","no"
"T1555.001","Keychain","Credential Access","no"
"T1559.002","Dynamic Data Exchange","Execution","Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7"
"T1559.001","Component Object Model","Execution","Gamaredon Group|MuddyWater"
"T1559","Inter-Process Communication","Execution","no"
"T1558.002","Silver Ticket","Credential Access","no"
"T1558.001","Golden Ticket","Credential Access","Ke3chang"
"T1558","Steal or Forge Kerberos Tickets","Credential Access","no"
"T1557.001","LLMNR/NBT-NS Poisoning and SMB Relay","Credential Access|Collection","Wizard Spider"
"T1557","Man-in-the-Middle","Credential Access|Collection","Kimsuky"
"T1556.002","Password Filter DLL","Credential Access|Defense Evasion|Persistence","Strider"
"T1556.001","Domain Controller Authentication","Credential Access|Defense Evasion|Persistence","Chimera"
"T1556","Modify Authentication Process","Credential Access|Defense Evasion|Persistence","no"
"T1056.004","Credential API Hooking","Collection|Credential Access","PLATINUM"
"T1056.003","Web Portal Capture","Collection|Credential Access","no"
"T1056.002","GUI Input Capture","Collection|Credential Access","FIN4"
"T1056.001","Keylogging","Collection|Credential Access","Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28"
"T1555","Credentials from Password Stores","Credential Access","APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon"
"T1552.005","Cloud Instance Metadata API","Credential Access","no"
"T1003.008","/etc/passwd and /etc/shadow","Credential Access","no"
"T1003.007","Proc Filesystem","Credential Access","no"
"T1003.006","DCSync","Credential Access","APT29|UNC2452|Operation Wocao"
"T1558.003","Kerberoasting","Credential Access","APT29|UNC2452|Operation Wocao|Wizard Spider"
"T1552.006","Group Policy Preferences","Credential Access","APT33"
"T1003.003","NTDS","Credential Access","Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0"
"T1003.002","Security Account Manager","Credential Access","Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass"
"T1003.001","LSASS Memory","Credential Access","HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver"
"T1110.004","Credential Stuffing","Credential Access","Chimera"
"T1110.003","Password Spraying","Credential Access","Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group"
"T1110.002","Password Cracking","Credential Access","FIN6|APT41|Dragonfly 2.0|APT3"
"T1110.001","Password Guessing","Credential Access","APT28"
"T1021.006","Windows Remote Management","Lateral Movement","APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390"
"T1021.005","VNC","Lateral Movement","Fox Kitten|GCMAN"
"T1021.004","SSH","Lateral Movement","Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN"
"T1021.003","Distributed Component Object Model","Lateral Movement","no"
"T1021.002","SMB/Windows Admin Shares","Lateral Movement","Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang"
"T1021.001","Remote Desktop Protocol","Lateral Movement","Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom"
"T1554","Compromise Client Software Binary","Persistence","no"
"T1036.006","Space after Filename","Defense Evasion","no"
"T1036.005","Match Legitimate Name or Location","Defense Evasion","APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1"
"T1036.004","Masquerade Task or Service","Defense Evasion","ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7"
"T1036.003","Rename System Utilities","Defense Evasion","menuPass|APT32|GALLIUM"
"T1036.002","Right-to-Left Override","Defense Evasion","BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic"
"T1036.001","Invalid Code Signature","Defense Evasion","Windshift|APT37"
"T1553.003","SIP and Trust Provider Hijacking","Defense Evasion","no"
"T1553.002","Code Signing","Defense Evasion","APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel"
"T1553.001","Gatekeeper Bypass","Defense Evasion","no"
"T1553","Subvert Trust Controls","Defense Evasion","no"
"T1027.003","Steganography","Defense Evasion","TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37"
"T1027.002","Software Packing","Defense Evasion","ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon"
"T1027.001","Binary Padding","Defense Evasion","Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee"
"T1222.002","Linux and Mac File and Directory Permissions Modification","Defense Evasion","Rocke|APT32"
"T1222.001","Windows File and Directory Permissions Modification","Defense Evasion","Wizard Spider"
"T1552.004","Private Keys","Credential Access","APT29|UNC2452|Operation Wocao|Rocke"
"T1552.003","Bash History","Credential Access","no"
"T1552.002","Credentials in Registry","Credential Access","APT32"
"T1552.001","Credentials In Files","Credential Access","Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3"
"T1552","Unsecured Credentials","Credential Access","no"
"T1216.001","PubPrn","Defense Evasion","APT32"
"T1070.006","Timestomp","Defense Evasion","APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28"
"T1070.005","Network Share Connection Removal","Defense Evasion","Threat Group-3390"
"T1070.004","File Deletion","Defense Evasion","APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29"
"T1070.003","Clear Command History","Defense Evasion","APT41"
"T1550.004","Web Session Cookie","Defense Evasion|Lateral Movement","APT29|UNC2452"
"T1550.001","Application Access Token","Defense Evasion|Lateral Movement","APT28"
"T1550.003","Pass the Ticket","Defense Evasion|Lateral Movement","APT32|BRONZE BUTLER|APT29"
"T1550.002","Pass the Hash","Defense Evasion|Lateral Movement","Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1"
"T1550","Use Alternate Authentication Material","Defense Evasion|Lateral Movement","APT29|UNC2452"
"T1548.004","Elevated Execution with Prompt","Privilege Escalation|Defense Evasion","no"
"T1548.003","Sudo and Sudo Caching","Privilege Escalation|Defense Evasion","no"
"T1548.002","Bypass User Account Control","Privilege Escalation|Defense Evasion","Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29"
"T1548.001","Setuid and Setgid","Privilege Escalation|Defense Evasion","no"
"T1548","Abuse Elevation Control Mechanism","Privilege Escalation|Defense Evasion","no"
"T1136.003","Cloud Account","Persistence","no"
"T1070.002","Clear Linux or Mac System Logs","Defense Evasion","Rocke"
"T1070.001","Clear Windows Event Logs","Defense Evasion","Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28"
"T1136.002","Domain Account","Persistence","HAFNIUM|GALLIUM"
"T1136.001","Local Account","Persistence","Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3"
"T1547.011","Plist Modification","Persistence|Privilege Escalation","no"
"T1547.010","Port Monitors","Persistence|Privilege Escalation","no"
"T1547.009","Shortcut Modification","Persistence|Privilege Escalation","APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan"
"T1547.008","LSASS Driver","Persistence|Privilege Escalation","no"
"T1547.007","Re-opened Applications","Persistence|Privilege Escalation","no"
"T1547.006","Kernel Modules and Extensions","Persistence|Privilege Escalation","no"
"T1547.005","Security Support Provider","Persistence|Privilege Escalation","Lazarus Group"
"T1547.004","Winlogon Helper DLL","Persistence|Privilege Escalation","Wizard Spider|Tropic Trooper|Turla"
"T1547.003","Time Providers","Persistence|Privilege Escalation","no"
"T1546.014","Emond","Privilege Escalation|Persistence","no"
"T1546.013","PowerShell Profile","Privilege Escalation|Persistence","Turla"
"T1546.012","Image File Execution Options Injection","Privilege Escalation|Persistence","TEMP.Veles"
"T1218.008","Odbcconf","Defense Evasion","Cobalt Group"
"T1546.011","Application Shimming","Privilege Escalation|Persistence","FIN7"
"T1547.002","Authentication Package","Persistence|Privilege Escalation","no"
"T1546.010","AppInit DLLs","Privilege Escalation|Persistence","APT39"
"T1546.009","AppCert DLLs","Privilege Escalation|Persistence","Honeybee"
"T1218.007","Msiexec","Defense Evasion","ZIRCONIUM|Molerats|Machete|TA505|Rancor"
"T1546.008","Accessibility Features","Privilege Escalation|Persistence","Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom"
"T1546.007","Netsh Helper DLL","Privilege Escalation|Persistence","no"
"T1546.006","LC_LOAD_DYLIB Addition","Privilege Escalation|Persistence","no"
"T1546.005","Trap","Privilege Escalation|Persistence","no"
"T1546.004","Unix Shell Configuration Modification","Privilege Escalation|Persistence","no"
"T1546.003","Windows Management Instrumentation Event Subscription","Privilege Escalation|Persistence","Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29"
"T1546.002","Screensaver","Privilege Escalation|Persistence","no"
"T1546.001","Change Default File Association","Privilege Escalation|Persistence","Kimsuky"
"T1547.001","Registry Run Keys / Startup Folder","Persistence|Privilege Escalation","Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel"
"T1218.002","Control Panel","Defense Evasion","no"
"T1218.010","Regsvr32","Defense Evasion","TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda"
"T1218.009","Regsvcs/Regasm","Defense Evasion","no"
"T1218.005","Mshta","Defense Evasion","Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7"
"T1218.004","InstallUtil","Defense Evasion","Mustang Panda|menuPass"
"T1218.001","Compiled HTML File","Defense Evasion","APT41|Silence|Lazarus Group|Dark Caracal|OilRig"
"T1218.003","CMSTP","Defense Evasion","Cobalt Group|MuddyWater"
"T1218.011","Rundll32","Defense Evasion","HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28"
"T1547","Boot or Logon Autostart Execution","Persistence|Privilege Escalation","no"
"T1546","Event Triggered Execution","Privilege Escalation|Persistence","no"
"T1098.003","Add Office 365 Global Administrator Role","Persistence","no"
"T1098.002","Exchange Email Delegate Permissions","Persistence","APT29|UNC2452|Magic Hound"
"T1098.001","Additional Cloud Credentials","Persistence","APT29|UNC2452"
"T1543.004","Launch Daemon","Persistence|Privilege Escalation","no"
"T1543.003","Windows Service","Persistence|Privilege Escalation","PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak"
"T1543.002","Systemd Service","Persistence|Privilege Escalation","Rocke"
"T1543.001","Launch Agent","Persistence|Privilege Escalation","no"
"T1037.005","Startup Items","Persistence|Privilege Escalation","no"
"T1037.004","RC Scripts","Persistence|Privilege Escalation","no"
"T1055.012","Process Hollowing","Defense Evasion|Privilege Escalation","Threat Group-3390|Gorgon Group|menuPass|Patchwork"
"T1055.013","Process Doppelgänging","Defense Evasion|Privilege Escalation","Leafminer"
"T1055.011","Extra Window Memory Injection","Defense Evasion|Privilege Escalation","no"
"T1055.014","VDSO Hijacking","Defense Evasion|Privilege Escalation","no"
"T1055.009","Proc Memory","Defense Evasion|Privilege Escalation","no"
"T1055.008","Ptrace System Calls","Defense Evasion|Privilege Escalation","no"
"T1055.005","Thread Local Storage","Defense Evasion|Privilege Escalation","no"
"T1055.004","Asynchronous Procedure Call","Defense Evasion|Privilege Escalation","no"
"T1055.003","Thread Execution Hijacking","Defense Evasion|Privilege Escalation","no"
"T1055.002","Portable Executable Injection","Defense Evasion|Privilege Escalation","Rocke|Gorgon Group"
"T1055.001","Dynamic-link Library Injection","Defense Evasion|Privilege Escalation","Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda"
"T1037.003","Network Logon Script","Persistence|Privilege Escalation","no"
"T1543","Create or Modify System Process","Persistence|Privilege Escalation","no"
"T1037.002","Logon Script (Mac)","Persistence|Privilege Escalation","no"
"T1037.001","Logon Script (Windows)","Persistence|Privilege Escalation","Cobalt Group|APT28"
"T1542.003","Bootkit","Persistence|Defense Evasion","APT41|Lazarus Group|APT28"
"T1542.002","Component Firmware","Persistence|Defense Evasion","Equation"
"T1542.001","System Firmware","Persistence|Defense Evasion","no"
"T1505.003","Web Shell","Persistence","Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda"
"T1505.002","Transport Agent","Persistence","no"
"T1505.001","SQL Stored Procedures","Persistence","no"
"T1053.003","Cron","Execution|Persistence|Privilege Escalation","Rocke"
"T1053.004","Launchd","Execution|Persistence|Privilege Escalation","no"
"T1053.001","At (Linux)","Execution|Persistence|Privilege Escalation","no"
"T1053.005","Scheduled Task","Execution|Persistence|Privilege Escalation","Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29"
"T1053.002","At (Windows)","Execution|Persistence|Privilege Escalation","BRONZE BUTLER|Threat Group-3390|APT18"
"T1542","Pre-OS Boot","Defense Evasion|Persistence","no"
"T1137.001","Office Template Macros","Persistence","MuddyWater"
"T1137.004","Outlook Home Page","Persistence","OilRig"
"T1137.003","Outlook Forms","Persistence","no"
"T1137.005","Outlook Rules","Persistence","no"
"T1137.006","Add-ins","Persistence","Naikon"
"T1137.002","Office Test","Persistence","APT28"
"T1531","Account Access Removal","Impact","no"
"T1539","Steal Web Session Cookie","Credential Access","Evilnum"
"T1529","System Shutdown/Reboot","Impact","Lazarus Group|APT38|APT37"
"T1518","Software Discovery","Discovery","Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception"
"T1547.013","XDG Autostart Entries","Persistence|Privilege Escalation","no"
"T1534","Internal Spearphishing","Lateral Movement","Gamaredon Group"
"T1528","Steal Application Access Token","Credential Access","APT28"
"T1535","Unused/Unsupported Cloud Regions","Defense Evasion","no"
"T1525","Implant Internal Image","Persistence","no"
"T1538","Cloud Service Dashboard","Discovery","no"
"T1530","Data from Cloud Storage Object","Collection","Fox Kitten"
"T1578","Modify Cloud Compute Infrastructure","Defense Evasion","no"
"T1537","Transfer Data to Cloud Account","Exfiltration","no"
"T1526","Cloud Service Discovery","Discovery","no"
"T1505","Server Software Component","Persistence","no"
"T1499","Endpoint Denial of Service","Impact","Sandworm Team"
"T1497","Virtualization/Sandbox Evasion","Defense Evasion|Discovery","Darkhotel"
"T1498","Network Denial of Service","Impact","APT28"
"T1496","Resource Hijacking","Impact","Blue Mockingbird|Rocke|APT41|Lazarus Group"
"T1495","Firmware Corruption","Impact","no"
"T1491","Defacement","Impact","no"
"T1490","Inhibit System Recovery","Impact","no"
"T1489","Service Stop","Impact","Wizard Spider|Lazarus Group"
"T1486","Data Encrypted for Impact","Impact","Indrik Spider|APT41|TA505|APT38"
"T1485","Data Destruction","Impact","Sandworm Team|Lazarus Group|APT38"
"T1484","Domain Policy Modification","Defense Evasion|Privilege Escalation","no"
"T1482","Domain Trust Discovery","Discovery","APT29|Chimera|UNC2452"
"T1480","Execution Guardrails","Defense Evasion","no"
"T1222","File and Directory Permissions Modification","Defense Evasion","no"
"T1220","XSL Script Processing","Defense Evasion","Higaisa|Cobalt Group"
"T1221","Template Injection","Defense Evasion","Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus"
"T1189","Drive-by Compromise","Initial Access","Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM"
"T1190","Exploit Public-Facing Application","Initial Access","Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom"
"T1210","Exploitation of Remote Services","Lateral Movement","Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28"
"T1217","Browser Bookmark Discovery","Discovery","Chimera|Fox Kitten"
"T1213","Data from Information Repositories","Collection","Fox Kitten|FIN6|Turla"
"T1197","BITS Jobs","Defense Evasion|Persistence","APT39|Patchwork|APT41|Leviathan"
"T1219","Remote Access Software","Command And Control","Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak"
"T1195","Supply Chain Compromise","Initial Access","no"
"T1204","User Execution","Execution","no"
"T1212","Exploitation for Credential Access","Credential Access","no"
"T1211","Exploitation for Defense Evasion","Defense Evasion","APT28"
"T1200","Hardware Additions","Initial Access","DarkVishnya"
"T1202","Indirect Command Execution","Defense Evasion","no"
"T1201","Password Policy Discovery","Discovery","Chimera|Turla|OilRig"
"T1207","Rogue Domain Controller","Defense Evasion","no"
"T1203","Exploitation for Client Execution","Execution","Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood"
"T1216","Signed Script Proxy Execution","Defense Evasion","no"
"T1199","Trusted Relationship","Initial Access","Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass"
"T1218","Signed Binary Proxy Execution","Defense Evasion","no"
"T1205","Traffic Signaling","Defense Evasion|Persistence|Command And Control","no"
"T1176","Browser Extensions","Persistence","Kimsuky|Stolen Pencil"
"T1175","Component Object Model and Distributed COM","Lateral Movement|Execution","no"
"T1187","Forced Authentication","Credential Access","DarkHydrus|Dragonfly 2.0"
"T1185","Man in the Browser","Collection","no"
"T1149","LC_MAIN Hijacking","Defense Evasion","no"
"T1134","Access Token Manipulation","Defense Evasion|Privilege Escalation","FIN6|Blue Mockingbird"
"T1136","Create Account","Persistence","no"
"T1137","Office Application Startup","Persistence","Gamaredon Group|APT32"
"T1140","Deobfuscate/Decode Files or Information","Defense Evasion","APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER"
"T1135","Network Share Discovery","Discovery","Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug"
"T1153","Source","Execution","no"
"T1133","External Remote Services","Persistence|Initial Access","APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18"
"T1132","Data Encoding","Command And Control","no"
"T1129","Shared Modules","Execution","no"
"T1127","Trusted Developer Utilities Proxy Execution","Defense Evasion","no"
"T1125","Video Capture","Collection","Silence|FIN7"
"T1124","System Time Discovery","Discovery","Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla"
"T1123","Audio Capture","Collection","APT37"
"T1120","Peripheral Device Discovery","Discovery","Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28"
"T1119","Automated Collection","Collection","Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6"
"T1115","Clipboard Data","Collection","Operation Wocao|APT39|APT38"
"T1114","Email Collection","Collection","Silent Librarian"
"T1113","Screen Capture","Collection","GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28"
"T1112","Modify Registry","Defense Evasion","Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8"
"T1111","Two-Factor Authentication Interception","Credential Access","Chimera|Operation Wocao"
"T1110","Brute Force","Credential Access","APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla"
"T1108","Redundant Access","Defense Evasion|Persistence","no"
"T1106","Native API","Execution","Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group"
"T1105","Ingress Tool Transfer","Command And Control","HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28"
"T1104","Multi-Stage Channels","Command And Control","APT41|MuddyWater|APT3"
"T1102","Web Service","Command And Control","Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6"
"T1098","Account Manipulation","Persistence","APT3|Dragonfly 2.0|Lazarus Group"
"T1095","Non-Application Layer Protocol","Command And Control","HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3"
"T1092","Communication Through Removable Media","Command And Control","APT28"
"T1091","Replication Through Removable Media","Lateral Movement|Initial Access","Mustang Panda|Tropic Trooper|Darkhotel|APT28"
"T1090","Proxy","Command And Control","Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla"
"T1087","Account Discovery","Discovery","APT29|UNC2452"
"T1083","File and Directory Discovery","Discovery","APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang"
"T1082","System Information Discovery","Discovery","APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang"
"T1080","Taint Shared Content","Lateral Movement","Gamaredon Group|BRONZE BUTLER|Darkhotel"
"T1078","Valid Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak"
"T1074","Data Staged","Collection","Wizard Spider"
"T1072","Software Deployment Tools","Execution|Lateral Movement","Silence|APT32|Threat Group-1314"
"T1071","Application Layer Protocol","Command And Control","Rocke|Magic Hound|Dragonfly 2.0"
"T1070","Indicator Removal on Host","Defense Evasion","APT29|UNC2452"
"T1069","Permission Groups Discovery","Discovery","APT29|UNC2452|TA505|APT3"
"T1068","Exploitation for Privilege Escalation","Privilege Escalation","ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28"
"T1064","Scripting","Defense Evasion|Execution","no"
"T1062","Hypervisor","Persistence","no"
"T1061","Graphical User Interface","Execution","no"
"T1059","Command and Scripting Interpreter","Execution","Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang"
"T1057","Process Discovery","Discovery","APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang"
"T1056","Input Capture","Collection|Credential Access","APT39"
"T1055","Process Injection","Defense Evasion|Privilege Escalation","Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM"
"T1053","Scheduled Task/Job","Execution|Persistence|Privilege Escalation","no"
"T1052","Exfiltration Over Physical Medium","Exfiltration","no"
"T1051","Shared Webroot","Lateral Movement","no"
"T1049","System Network Connections Discovery","Discovery","Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang"
"T1048","Exfiltration Over Alternative Protocol","Exfiltration","no"
"T1047","Windows Management Instrumentation","Execution","Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda"
"T1046","Network Service Scanning","Discovery","Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390"
"T1043","Commonly Used Port","Command And Control","OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390"
"T1041","Exfiltration Over C2 Channel","Exfiltration","ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang"
"T1040","Network Sniffing","Credential Access|Discovery","Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28"
"T1039","Data from Network Shared Drive","Collection","Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass"
"T1037","Boot or Logon Initialization Scripts","Persistence|Privilege Escalation","Rocke"
"T1036","Masquerading","Defense Evasion","APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0"
"T1034","Path Interception","Persistence|Privilege Escalation","no"
"T1033","System Owner/User Discovery","Discovery","Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3"
"T1030","Data Transfer Size Limits","Exfiltration","Threat Group-3390"
"T1029","Scheduled Transfer","Exfiltration","Higaisa"
"T1027","Obfuscated Files or Information","Defense Evasion","APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28"
"T1026","Multiband Communication","Command And Control","Lazarus Group"
"T1025","Data from Removable Media","Collection","Turla|Gamaredon Group|APT28"
"T1021","Remote Services","Lateral Movement","no"
"T1020","Automated Exfiltration","Exfiltration","Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee"
"T1018","Remote System Discovery","Discovery","APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla"
"T1016","System Network Configuration Discovery","Discovery","ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang"
"T1014","Rootkit","Defense Evasion","Rocke|APT41|APT28|Winnti Group"
"T1012","Query Registry","Discovery","ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla"
"T1011","Exfiltration Over Other Network Medium","Exfiltration","no"
"T1010","Application Window Discovery","Discovery","Lazarus Group"
"T1008","Fallback Channels","Command And Control","Carbanak|APT41|OilRig|Lazarus Group"
"T1007","System Service Discovery","Discovery","Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang"
"T1006","Direct Volume Access","Defense Evasion","no"
"T1005","Data from Local System","Collection","APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang"
"T1003","OS Credential Dumping","Credential Access","APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom"
"T1001","Data Obfuscation","Command And Control","Operation Wocao|Axiom"
1 mitre_id technique tactics groups
2 T1553.006 Code Signing Policy Modification Defense Evasion Turla|APT39
3 T1614 System Location Discovery Discovery no
4 T1613 Container and Resource Discovery Discovery no
5 T1552.007 Container API Credential Access no
6 T1612 Build Image on Host Defense Evasion no
7 T1611 Escape to Host Privilege Escalation no
8 T1204.003 Malicious Image Execution no
9 T1053.007 Container Orchestration Job Execution|Persistence|Privilege Escalation no
10 T1610 Deploy Container Defense Evasion|Execution no
11 T1609 Container Administration Command Execution no
12 T1608.005 Link Target Resource Development Silent Librarian
13 T1608.004 Drive-by Target Resource Development APT32|Threat Group-3390
14 T1608.003 Install Digital Certificate Resource Development no
15 T1608.002 Upload Tool Resource Development Threat Group-3390
16 T1608.001 Upload Malware Resource Development APT32
17 T1608 Stage Capabilities Resource Development no
18 T1016.001 Internet Connection Discovery Discovery APT29|UNC2452|Turla
19 T1553.005 Mark-of-the-Web Bypass Defense Evasion TA505
20 T1555.005 Password Managers Credential Access Fox Kitten|Operation Wocao
21 T1484.002 Domain Trust Modification Defense Evasion|Privilege Escalation APT29|UNC2452
22 T1484.001 Group Policy Modification Defense Evasion|Privilege Escalation Indrik Spider
23 T1547.014 Active Setup Persistence|Privilege Escalation no
24 T1606.002 SAML Tokens Credential Access APT29|UNC2452
25 T1606.001 Web Cookies Credential Access APT29|UNC2452
26 T1606 Forge Web Credentials Credential Access no
27 T1555.004 Windows Credential Manager Credential Access Stealth Falcon|OilRig|Turla
28 T1059.008 Network Device CLI Execution no
29 T1602.002 Network Device Configuration Dump Collection no
30 T1542.005 TFTP Boot Defense Evasion|Persistence no
31 T1542.004 ROMMONkit Defense Evasion|Persistence no
32 T1602.001 SNMP (MIB Dump) Collection no
33 T1602 Data from Configuration Repository Collection no
34 T1601.002 Downgrade System Image Defense Evasion no
35 T1601.001 Patch System Image Defense Evasion no
36 T1601 Modify System Image Defense Evasion no
37 T1600.002 Disable Crypto Hardware Defense Evasion no
38 T1600.001 Reduce Key Space Defense Evasion no
39 T1600 Weaken Encryption Defense Evasion no
40 T1556.004 Network Device Authentication Credential Access|Defense Evasion|Persistence no
41 T1599.001 Network Address Translation Traversal Defense Evasion no
42 T1599 Network Boundary Bridging Defense Evasion no
43 T1020.001 Traffic Duplication Exfiltration no
44 T1557.002 ARP Cache Poisoning Credential Access|Collection Cleaver
45 T1588.006 Vulnerabilities Resource Development Sandworm Team
46 T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
47 T1562.008 Disable Cloud Logs Defense Evasion no
48 T1547.012 Print Processors Persistence|Privilege Escalation no
49 T1598.003 Spearphishing Link Reconnaissance Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
50 T1598.002 Spearphishing Attachment Reconnaissance Sidewinder
51 T1598.001 Spearphishing Service Reconnaissance no
52 T1598 Phishing for Information Reconnaissance ZIRCONIUM|APT28
53 T1597.002 Purchase Technical Data Reconnaissance no
54 T1597.001 Threat Intel Vendors Reconnaissance no
55 T1597 Search Closed Sources Reconnaissance no
56 T1596.005 Scan Databases Reconnaissance no
57 T1596.004 CDNs Reconnaissance no
58 T1596.003 Digital Certificates Reconnaissance no
59 T1596.001 DNS/Passive DNS Reconnaissance no
60 T1596.002 WHOIS Reconnaissance no
61 T1596 Search Open Technical Databases Reconnaissance no
62 T1595.002 Vulnerability Scanning Reconnaissance Volatile Cedar|APT28|Sandworm Team
63 T1595.001 Scanning IP Blocks Reconnaissance no
64 T1595 Active Scanning Reconnaissance no
65 T1594 Search Victim-Owned Websites Reconnaissance Silent Librarian|Sandworm Team
66 T1593.002 Search Engines Reconnaissance no
67 T1593.001 Social Media Reconnaissance no
68 T1593 Search Open Websites/Domains Reconnaissance Sandworm Team
69 T1592.004 Client Configurations Reconnaissance HAFNIUM
70 T1592.003 Firmware Reconnaissance no
71 T1592.002 Software Reconnaissance Sandworm Team
72 T1592.001 Hardware Reconnaissance no
73 T1592 Gather Victim Host Information Reconnaissance no
74 T1591.004 Identify Roles Reconnaissance no
75 T1591.003 Identify Business Tempo Reconnaissance no
76 T1591.001 Determine Physical Locations Reconnaissance no
77 T1591.002 Business Relationships Reconnaissance Sandworm Team
78 T1591 Gather Victim Org Information Reconnaissance no
79 T1590.006 Network Security Appliances Reconnaissance no
80 T1590.005 IP Addresses Reconnaissance HAFNIUM
81 T1590.004 Network Topology Reconnaissance no
82 T1590.003 Network Trust Dependencies Reconnaissance no
83 T1590.002 DNS Reconnaissance no
84 T1590.001 Domain Properties Reconnaissance Sandworm Team
85 T1590 Gather Victim Network Information Reconnaissance HAFNIUM
86 T1589.003 Employee Names Reconnaissance Silent Librarian|Sandworm Team
87 T1589.002 Email Addresses Reconnaissance TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
88 T1589.001 Credentials Reconnaissance APT28|Magic Hound|Chimera
89 T1589 Gather Victim Identity Information Reconnaissance APT32
90 T1588.005 Exploits Resource Development no
91 T1588.004 Digital Certificates Resource Development Lazarus Group|Silent Librarian
92 T1588.003 Code Signing Certificates Resource Development Wizard Spider
93 T1588.002 Tool Resource Development MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
94 T1588.001 Malware Resource Development Turla|APT1
95 T1588 Obtain Capabilities Resource Development no
96 T1587.004 Exploits Resource Development no
97 T1587.003 Digital Certificates Resource Development APT29|PROMETHIUM
98 T1587.002 Code Signing Certificates Resource Development PROMETHIUM|Patchwork
99 T1587.001 Malware Resource Development APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
100 T1587 Develop Capabilities Resource Development Kimsuky
101 T1586.002 Email Accounts Resource Development Magic Hound|Kimsuky
102 T1586.001 Social Media Accounts Resource Development no
103 T1586 Compromise Accounts Resource Development no
104 T1585.002 Email Accounts Resource Development Magic Hound|Silent Librarian|Sandworm Team|APT1
105 T1585.001 Social Media Accounts Resource Development Fox Kitten|Sandworm Team|APT32|Cleaver
106 T1585 Establish Accounts Resource Development Fox Kitten|APT17
107 T1584.006 Web Services Resource Development Turla
108 T1584.005 Botnet Resource Development no
109 T1584.004 Server Resource Development Indrik Spider|Turla|APT16
110 T1584.003 Virtual Private Server Resource Development Turla
111 T1584.002 DNS Server Resource Development no
112 T1584.001 Domains Resource Development APT29|UNC2452|APT1
113 T1583.006 Web Services Resource Development ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
114 T1583.005 Botnet Resource Development no
115 T1583.004 Server Resource Development GALLIUM|Sandworm Team
116 T1583.003 Virtual Private Server Resource Development HAFNIUM|TEMP.Veles
117 T1583.002 DNS Server Resource Development no
118 T1584 Compromise Infrastructure Resource Development no
119 T1583.001 Domains Resource Development APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
120 T1583 Acquire Infrastructure Resource Development no
121 T1564.007 VBA Stomping Defense Evasion no
122 T1558.004 AS-REP Roasting Credential Access no
123 T1580 Cloud Infrastructure Discovery Discovery no
124 T1218.012 Verclsid Defense Evasion no
125 T1205.001 Port Knocking Defense Evasion|Persistence|Command And Control PROMETHIUM
126 T1564.006 Run Virtual Instance Defense Evasion no
127 T1564.005 Hidden File System Defense Evasion Strider|Equation
128 T1556.003 Pluggable Authentication Modules Credential Access|Defense Evasion|Persistence no
129 T1574.012 COR_PROFILER Persistence|Privilege Escalation|Defense Evasion Blue Mockingbird
130 T1562.007 Disable or Modify Cloud Firewall Defense Evasion no
131 T1098.004 SSH Authorized Keys Persistence no
132 T1480.001 Environmental Keying Defense Evasion APT41|Equation
133 T1059.007 JavaScript Execution MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
134 T1578.004 Revert Cloud Instance Defense Evasion no
135 T1578.003 Delete Cloud Instance Defense Evasion no
136 T1578.001 Create Snapshot Defense Evasion no
137 T1578.002 Create Cloud Instance Defense Evasion no
138 T1127.001 MSBuild Defense Evasion Frankenstein
139 T1027.005 Indicator Removal from Tools Defense Evasion Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
140 T1562.006 Indicator Blocking Defense Evasion no
141 T1573.002 Asymmetric Cryptography Command And Control Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
142 T1573.001 Symmetric Cryptography Command And Control Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
143 T1573 Encrypted Channel Command And Control Tropic Trooper
144 T1027.004 Compile After Delivery Defense Evasion Gamaredon Group|Rocke|MuddyWater
145 T1574.004 Dylib Hijacking Persistence|Privilege Escalation|Defense Evasion no
146 T1546.015 Component Object Model Hijacking Privilege Escalation|Persistence APT28
147 T1071.004 DNS Command And Control Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
148 T1071.003 Mail Protocols Command And Control Turla|Kimsuky|APT32|SilverTerrier|APT28
149 T1071.002 File Transfer Protocols Command And Control Kimsuky|APT41|SilverTerrier|Honeybee
150 T1071.001 Web Protocols Command And Control APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon
151 T1572 Protocol Tunneling Command And Control Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
152 T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
153 T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration APT29|UNC2452
154 T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration no
155 T1001.003 Protocol Impersonation Command And Control Higaisa|Lazarus Group
156 T1001.002 Steganography Command And Control APT29|Axiom
157 T1001.001 Junk Data Command And Control APT28
158 T1132.002 Non-Standard Encoding Command And Control no
159 T1132.001 Standard Encoding Command And Control HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
160 T1090.004 Domain Fronting Command And Control APT29
161 T1090.003 Multi-hop Proxy Command And Control APT28|Operation Wocao|Inception|FIN4|APT29
162 T1090.002 External Proxy Command And Control APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
163 T1090.001 Internal Proxy Command And Control APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
164 T1102.003 One-Way Communication Command And Control Leviathan
165 T1102.002 Bidirectional Communication Command And Control ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak
166 T1102.001 Dead Drop Resolver Command And Control Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
167 T1571 Non-Standard Port Command And Control Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
168 T1074.002 Remote Data Staging Collection APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
169 T1074.001 Local Data Staging Collection Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
170 T1078.004 Cloud Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT33
171 T1564.004 NTFS File Attributes Defense Evasion APT32
172 T1564.003 Hidden Window Defense Evasion Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
173 T1078.003 Local Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
174 T1078.002 Domain Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
175 T1078.001 Default Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access no
176 T1564.002 Hidden Users Defense Evasion no
177 T1574.006 Dynamic Linker Hijacking Persistence|Privilege Escalation|Defense Evasion APT41|Rocke
178 T1574.002 DLL Side-Loading Persistence|Privilege Escalation|Defense Evasion Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
179 T1574.001 DLL Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
180 T1574.008 Path Interception by Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion no
181 T1574.007 Path Interception by PATH Environment Variable Persistence|Privilege Escalation|Defense Evasion no
182 T1574.009 Path Interception by Unquoted Path Persistence|Privilege Escalation|Defense Evasion no
183 T1574.011 Services Registry Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
184 T1574.005 Executable Installer File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
185 T1574.010 Services File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
186 T1574 Hijack Execution Flow Persistence|Privilege Escalation|Defense Evasion no
187 T1069.001 Local Groups Discovery Chimera|Operation Wocao|Turla|OilRig|admin@338
188 T1570 Lateral Tool Transfer Lateral Movement Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
189 T1568.003 DNS Calculation Command And Control APT12
190 T1204.002 Malicious File Execution Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan
191 T1204.001 Malicious Link Execution APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
192 T1195.003 Compromise Hardware Supply Chain Initial Access no
193 T1195.002 Compromise Software Supply Chain Initial Access APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
194 T1195.001 Compromise Software Dependencies and Development Tools Initial Access no
195 T1568.001 Fast Flux DNS Command And Control menuPass|TA505
196 T1052.001 Exfiltration over USB Exfiltration Mustang Panda|Tropic Trooper
197 T1569.002 Service Execution Execution Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
198 T1569.001 Launchctl Execution no
199 T1569 System Services Execution no
200 T1568.002 Domain Generation Algorithms Command And Control TA551|APT41
201 T1568 Dynamic Resolution Command And Control APT29|UNC2452
202 T1011.001 Exfiltration Over Bluetooth Exfiltration no
203 T1567.002 Exfiltration to Cloud Storage Exfiltration ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
204 T1567.001 Exfiltration to Code Repository Exfiltration no
205 T1059.006 Python Execution ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
206 T1059.005 Visual Basic Execution Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
207 T1059.004 Unix Shell Execution Rocke|APT41
208 T1059.003 Windows Command Shell Execution APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
209 T1059.002 AppleScript Execution no
210 T1059.001 PowerShell Execution Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
211 T1567 Exfiltration Over Web Service Exfiltration APT28
212 T1497.003 Time Based Evasion Defense Evasion|Discovery no
213 T1497.002 User Activity Based Checks Defense Evasion|Discovery Darkhotel|FIN7
214 T1497.001 System Checks Defense Evasion|Discovery Darkhotel|Evilnum|Frankenstein
215 T1498.002 Reflection Amplification Impact no
216 T1498.001 Direct Network Flood Impact no
217 T1566.003 Spearphishing via Service Initial Access Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
218 T1566.002 Spearphishing Link Initial Access Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound
219 T1566.001 Spearphishing Attachment Initial Access Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM
220 T1566 Phishing Initial Access GOLD SOUTHFIELD|Dragonfly
221 T1565.003 Runtime Data Manipulation Impact APT38
222 T1565.002 Transmitted Data Manipulation Impact APT38
223 T1565.001 Stored Data Manipulation Impact FIN4|APT38
224 T1565 Data Manipulation Impact no
225 T1564.001 Hidden Files and Directories Defense Evasion Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28
226 T1564 Hide Artifacts Defense Evasion no
227 T1563.002 RDP Hijacking Lateral Movement no
228 T1563.001 SSH Hijacking Lateral Movement no
229 T1563 Remote Service Session Hijacking Lateral Movement no
230 T1518.001 Security Software Discovery Discovery Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
231 T1069.003 Cloud Groups Discovery no
232 T1069.002 Domain Groups Discovery Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
233 T1087.004 Cloud Account Discovery no
234 T1087.003 Email Account Discovery Sandworm Team|TA505
235 T1087.002 Domain Account Discovery MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang
236 T1087.001 Local Account Discovery Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
237 T1553.004 Install Root Certificate Defense Evasion no
238 T1562.004 Disable or Modify System Firewall Defense Evasion APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
239 T1562.003 Impair Command History Logging Defense Evasion no
240 T1562.002 Disable Windows Event Logging Defense Evasion APT29|UNC2452|Threat Group-3390
241 T1562.001 Disable or Modify Tools Defense Evasion APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
242 T1562 Impair Defenses Defense Evasion no
243 T1003.004 LSA Secrets Credential Access OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
244 T1003.005 Cached Domain Credentials Credential Access OilRig|MuddyWater|Leafminer|APT33
245 T1561.002 Disk Structure Wipe Impact Sandworm Team|Lazarus Group|APT38|APT37
246 T1561.001 Disk Content Wipe Impact Lazarus Group
247 T1561 Disk Wipe Impact no
248 T1560.003 Archive via Custom Method Collection Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
249 T1560.002 Archive via Library Collection Lazarus Group|Threat Group-3390
250 T1560.001 Archive via Utility Collection APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
251 T1560 Archive Collected Data Collection menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
252 T1499.004 Application or System Exploitation Impact no
253 T1499.003 Application Exhaustion Flood Impact no
254 T1499.002 Service Exhaustion Flood Impact no
255 T1499.001 OS Exhaustion Flood Impact no
256 T1491.002 External Defacement Impact Sandworm Team
257 T1491.001 Internal Defacement Impact Lazarus Group
258 T1114.003 Email Forwarding Rule Collection Silent Librarian|Kimsuky
259 T1114.002 Remote Email Collection Collection APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang
260 T1114.001 Local Email Collection Collection Chimera|Magic Hound|APT1
261 T1134.005 SID-History Injection Defense Evasion|Privilege Escalation no
262 T1134.004 Parent PID Spoofing Defense Evasion|Privilege Escalation no
263 T1134.003 Make and Impersonate Token Defense Evasion|Privilege Escalation no
264 T1134.002 Create Process with Token Defense Evasion|Privilege Escalation Turla|Lazarus Group
265 T1134.001 Token Impersonation/Theft Defense Evasion|Privilege Escalation APT28
266 T1213.002 Sharepoint Collection Chimera|Ke3chang|APT28
267 T1213.001 Confluence Collection no
268 T1555.003 Credentials from Web Browsers Credential Access Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
269 T1555.002 Securityd Memory Credential Access no
270 T1555.001 Keychain Credential Access no
271 T1559.002 Dynamic Data Exchange Execution Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
272 T1559.001 Component Object Model Execution Gamaredon Group|MuddyWater
273 T1559 Inter-Process Communication Execution no
274 T1558.002 Silver Ticket Credential Access no
275 T1558.001 Golden Ticket Credential Access Ke3chang
276 T1558 Steal or Forge Kerberos Tickets Credential Access no
277 T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay Credential Access|Collection Wizard Spider
278 T1557 Man-in-the-Middle Credential Access|Collection Kimsuky
279 T1556.002 Password Filter DLL Credential Access|Defense Evasion|Persistence Strider
280 T1556.001 Domain Controller Authentication Credential Access|Defense Evasion|Persistence Chimera
281 T1556 Modify Authentication Process Credential Access|Defense Evasion|Persistence no
282 T1056.004 Credential API Hooking Collection|Credential Access PLATINUM
283 T1056.003 Web Portal Capture Collection|Credential Access no
284 T1056.002 GUI Input Capture Collection|Credential Access FIN4
285 T1056.001 Keylogging Collection|Credential Access Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
286 T1555 Credentials from Password Stores Credential Access APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
287 T1552.005 Cloud Instance Metadata API Credential Access no
288 T1003.008 /etc/passwd and /etc/shadow Credential Access no
289 T1003.007 Proc Filesystem Credential Access no
290 T1003.006 DCSync Credential Access APT29|UNC2452|Operation Wocao
291 T1558.003 Kerberoasting Credential Access APT29|UNC2452|Operation Wocao|Wizard Spider
292 T1552.006 Group Policy Preferences Credential Access APT33
293 T1003.003 NTDS Credential Access Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
294 T1003.002 Security Account Manager Credential Access Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
295 T1003.001 LSASS Memory Credential Access HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
296 T1110.004 Credential Stuffing Credential Access Chimera
297 T1110.003 Password Spraying Credential Access Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
298 T1110.002 Password Cracking Credential Access FIN6|APT41|Dragonfly 2.0|APT3
299 T1110.001 Password Guessing Credential Access APT28
300 T1021.006 Windows Remote Management Lateral Movement APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
301 T1021.005 VNC Lateral Movement Fox Kitten|GCMAN
302 T1021.004 SSH Lateral Movement Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
303 T1021.003 Distributed Component Object Model Lateral Movement no
304 T1021.002 SMB/Windows Admin Shares Lateral Movement Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
305 T1021.001 Remote Desktop Protocol Lateral Movement Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
306 T1554 Compromise Client Software Binary Persistence no
307 T1036.006 Space after Filename Defense Evasion no
308 T1036.005 Match Legitimate Name or Location Defense Evasion APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
309 T1036.004 Masquerade Task or Service Defense Evasion ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
310 T1036.003 Rename System Utilities Defense Evasion menuPass|APT32|GALLIUM
311 T1036.002 Right-to-Left Override Defense Evasion BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
312 T1036.001 Invalid Code Signature Defense Evasion Windshift|APT37
313 T1553.003 SIP and Trust Provider Hijacking Defense Evasion no
314 T1553.002 Code Signing Defense Evasion APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
315 T1553.001 Gatekeeper Bypass Defense Evasion no
316 T1553 Subvert Trust Controls Defense Evasion no
317 T1027.003 Steganography Defense Evasion TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
318 T1027.002 Software Packing Defense Evasion ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
319 T1027.001 Binary Padding Defense Evasion Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
320 T1222.002 Linux and Mac File and Directory Permissions Modification Defense Evasion Rocke|APT32
321 T1222.001 Windows File and Directory Permissions Modification Defense Evasion Wizard Spider
322 T1552.004 Private Keys Credential Access APT29|UNC2452|Operation Wocao|Rocke
323 T1552.003 Bash History Credential Access no
324 T1552.002 Credentials in Registry Credential Access APT32
325 T1552.001 Credentials In Files Credential Access Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
326 T1552 Unsecured Credentials Credential Access no
327 T1216.001 PubPrn Defense Evasion APT32
328 T1070.006 Timestomp Defense Evasion APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
329 T1070.005 Network Share Connection Removal Defense Evasion Threat Group-3390
330 T1070.004 File Deletion Defense Evasion APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29
331 T1070.003 Clear Command History Defense Evasion APT41
332 T1550.004 Web Session Cookie Defense Evasion|Lateral Movement APT29|UNC2452
333 T1550.001 Application Access Token Defense Evasion|Lateral Movement APT28
334 T1550.003 Pass the Ticket Defense Evasion|Lateral Movement APT32|BRONZE BUTLER|APT29
335 T1550.002 Pass the Hash Defense Evasion|Lateral Movement Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
336 T1550 Use Alternate Authentication Material Defense Evasion|Lateral Movement APT29|UNC2452
337 T1548.004 Elevated Execution with Prompt Privilege Escalation|Defense Evasion no
338 T1548.003 Sudo and Sudo Caching Privilege Escalation|Defense Evasion no
339 T1548.002 Bypass User Account Control Privilege Escalation|Defense Evasion Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
340 T1548.001 Setuid and Setgid Privilege Escalation|Defense Evasion no
341 T1548 Abuse Elevation Control Mechanism Privilege Escalation|Defense Evasion no
342 T1136.003 Cloud Account Persistence no
343 T1070.002 Clear Linux or Mac System Logs Defense Evasion Rocke
344 T1070.001 Clear Windows Event Logs Defense Evasion Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
345 T1136.002 Domain Account Persistence HAFNIUM|GALLIUM
346 T1136.001 Local Account Persistence Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3
347 T1547.011 Plist Modification Persistence|Privilege Escalation no
348 T1547.010 Port Monitors Persistence|Privilege Escalation no
349 T1547.009 Shortcut Modification Persistence|Privilege Escalation APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan
350 T1547.008 LSASS Driver Persistence|Privilege Escalation no
351 T1547.007 Re-opened Applications Persistence|Privilege Escalation no
352 T1547.006 Kernel Modules and Extensions Persistence|Privilege Escalation no
353 T1547.005 Security Support Provider Persistence|Privilege Escalation Lazarus Group
354 T1547.004 Winlogon Helper DLL Persistence|Privilege Escalation Wizard Spider|Tropic Trooper|Turla
355 T1547.003 Time Providers Persistence|Privilege Escalation no
356 T1546.014 Emond Privilege Escalation|Persistence no
357 T1546.013 PowerShell Profile Privilege Escalation|Persistence Turla
358 T1546.012 Image File Execution Options Injection Privilege Escalation|Persistence TEMP.Veles
359 T1218.008 Odbcconf Defense Evasion Cobalt Group
360 T1546.011 Application Shimming Privilege Escalation|Persistence FIN7
361 T1547.002 Authentication Package Persistence|Privilege Escalation no
362 T1546.010 AppInit DLLs Privilege Escalation|Persistence APT39
363 T1546.009 AppCert DLLs Privilege Escalation|Persistence Honeybee
364 T1218.007 Msiexec Defense Evasion ZIRCONIUM|Molerats|Machete|TA505|Rancor
365 T1546.008 Accessibility Features Privilege Escalation|Persistence Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
366 T1546.007 Netsh Helper DLL Privilege Escalation|Persistence no
367 T1546.006 LC_LOAD_DYLIB Addition Privilege Escalation|Persistence no
368 T1546.005 Trap Privilege Escalation|Persistence no
369 T1546.004 Unix Shell Configuration Modification Privilege Escalation|Persistence no
370 T1546.003 Windows Management Instrumentation Event Subscription Privilege Escalation|Persistence Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
371 T1546.002 Screensaver Privilege Escalation|Persistence no
372 T1546.001 Change Default File Association Privilege Escalation|Persistence Kimsuky
373 T1547.001 Registry Run Keys / Startup Folder Persistence|Privilege Escalation Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
374 T1218.002 Control Panel Defense Evasion no
375 T1218.010 Regsvr32 Defense Evasion TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda
376 T1218.009 Regsvcs/Regasm Defense Evasion no
377 T1218.005 Mshta Defense Evasion Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7
378 T1218.004 InstallUtil Defense Evasion Mustang Panda|menuPass
379 T1218.001 Compiled HTML File Defense Evasion APT41|Silence|Lazarus Group|Dark Caracal|OilRig
380 T1218.003 CMSTP Defense Evasion Cobalt Group|MuddyWater
381 T1218.011 Rundll32 Defense Evasion HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
382 T1547 Boot or Logon Autostart Execution Persistence|Privilege Escalation no
383 T1546 Event Triggered Execution Privilege Escalation|Persistence no
384 T1098.003 Add Office 365 Global Administrator Role Persistence no
385 T1098.002 Exchange Email Delegate Permissions Persistence APT29|UNC2452|Magic Hound
386 T1098.001 Additional Cloud Credentials Persistence APT29|UNC2452
387 T1543.004 Launch Daemon Persistence|Privilege Escalation no
388 T1543.003 Windows Service Persistence|Privilege Escalation PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak
389 T1543.002 Systemd Service Persistence|Privilege Escalation Rocke
390 T1543.001 Launch Agent Persistence|Privilege Escalation no
391 T1037.005 Startup Items Persistence|Privilege Escalation no
392 T1037.004 RC Scripts Persistence|Privilege Escalation no
393 T1055.012 Process Hollowing Defense Evasion|Privilege Escalation Threat Group-3390|Gorgon Group|menuPass|Patchwork
394 T1055.013 Process Doppelgänging Defense Evasion|Privilege Escalation Leafminer
395 T1055.011 Extra Window Memory Injection Defense Evasion|Privilege Escalation no
396 T1055.014 VDSO Hijacking Defense Evasion|Privilege Escalation no
397 T1055.009 Proc Memory Defense Evasion|Privilege Escalation no
398 T1055.008 Ptrace System Calls Defense Evasion|Privilege Escalation no
399 T1055.005 Thread Local Storage Defense Evasion|Privilege Escalation no
400 T1055.004 Asynchronous Procedure Call Defense Evasion|Privilege Escalation no
401 T1055.003 Thread Execution Hijacking Defense Evasion|Privilege Escalation no
402 T1055.002 Portable Executable Injection Defense Evasion|Privilege Escalation Rocke|Gorgon Group
403 T1055.001 Dynamic-link Library Injection Defense Evasion|Privilege Escalation Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
404 T1037.003 Network Logon Script Persistence|Privilege Escalation no
405 T1543 Create or Modify System Process Persistence|Privilege Escalation no
406 T1037.002 Logon Script (Mac) Persistence|Privilege Escalation no
407 T1037.001 Logon Script (Windows) Persistence|Privilege Escalation Cobalt Group|APT28
408 T1542.003 Bootkit Persistence|Defense Evasion APT41|Lazarus Group|APT28
409 T1542.002 Component Firmware Persistence|Defense Evasion Equation
410 T1542.001 System Firmware Persistence|Defense Evasion no
411 T1505.003 Web Shell Persistence Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
412 T1505.002 Transport Agent Persistence no
413 T1505.001 SQL Stored Procedures Persistence no
414 T1053.003 Cron Execution|Persistence|Privilege Escalation Rocke
415 T1053.004 Launchd Execution|Persistence|Privilege Escalation no
416 T1053.001 At (Linux) Execution|Persistence|Privilege Escalation no
417 T1053.005 Scheduled Task Execution|Persistence|Privilege Escalation Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29
418 T1053.002 At (Windows) Execution|Persistence|Privilege Escalation BRONZE BUTLER|Threat Group-3390|APT18
419 T1542 Pre-OS Boot Defense Evasion|Persistence no
420 T1137.001 Office Template Macros Persistence MuddyWater
421 T1137.004 Outlook Home Page Persistence OilRig
422 T1137.003 Outlook Forms Persistence no
423 T1137.005 Outlook Rules Persistence no
424 T1137.006 Add-ins Persistence Naikon
425 T1137.002 Office Test Persistence APT28
426 T1531 Account Access Removal Impact no
427 T1539 Steal Web Session Cookie Credential Access Evilnum
428 T1529 System Shutdown/Reboot Impact Lazarus Group|APT38|APT37
429 T1518 Software Discovery Discovery Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
430 T1547.013 XDG Autostart Entries Persistence|Privilege Escalation no
431 T1534 Internal Spearphishing Lateral Movement Gamaredon Group
432 T1528 Steal Application Access Token Credential Access APT28
433 T1535 Unused/Unsupported Cloud Regions Defense Evasion no
434 T1525 Implant Internal Image Persistence no
435 T1538 Cloud Service Dashboard Discovery no
436 T1530 Data from Cloud Storage Object Collection Fox Kitten
437 T1578 Modify Cloud Compute Infrastructure Defense Evasion no
438 T1537 Transfer Data to Cloud Account Exfiltration no
439 T1526 Cloud Service Discovery Discovery no
440 T1505 Server Software Component Persistence no
441 T1499 Endpoint Denial of Service Impact Sandworm Team
442 T1497 Virtualization/Sandbox Evasion Defense Evasion|Discovery Darkhotel
443 T1498 Network Denial of Service Impact APT28
444 T1496 Resource Hijacking Impact Blue Mockingbird|Rocke|APT41|Lazarus Group
445 T1495 Firmware Corruption Impact no
446 T1491 Defacement Impact no
447 T1490 Inhibit System Recovery Impact no
448 T1489 Service Stop Impact Wizard Spider|Lazarus Group
449 T1486 Data Encrypted for Impact Impact Indrik Spider|APT41|TA505|APT38
450 T1485 Data Destruction Impact Sandworm Team|Lazarus Group|APT38
451 T1484 Domain Policy Modification Defense Evasion|Privilege Escalation no
452 T1482 Domain Trust Discovery Discovery APT29|Chimera|UNC2452
453 T1480 Execution Guardrails Defense Evasion no
454 T1222 File and Directory Permissions Modification Defense Evasion no
455 T1220 XSL Script Processing Defense Evasion Higaisa|Cobalt Group
456 T1221 Template Injection Defense Evasion Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
457 T1189 Drive-by Compromise Initial Access Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM
458 T1190 Exploit Public-Facing Application Initial Access Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
459 T1210 Exploitation of Remote Services Lateral Movement Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
460 T1217 Browser Bookmark Discovery Discovery Chimera|Fox Kitten
461 T1213 Data from Information Repositories Collection Fox Kitten|FIN6|Turla
462 T1197 BITS Jobs Defense Evasion|Persistence APT39|Patchwork|APT41|Leviathan
463 T1219 Remote Access Software Command And Control Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
464 T1195 Supply Chain Compromise Initial Access no
465 T1204 User Execution Execution no
466 T1212 Exploitation for Credential Access Credential Access no
467 T1211 Exploitation for Defense Evasion Defense Evasion APT28
468 T1200 Hardware Additions Initial Access DarkVishnya
469 T1202 Indirect Command Execution Defense Evasion no
470 T1201 Password Policy Discovery Discovery Chimera|Turla|OilRig
471 T1207 Rogue Domain Controller Defense Evasion no
472 T1203 Exploitation for Client Execution Execution Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood
473 T1216 Signed Script Proxy Execution Defense Evasion no
474 T1199 Trusted Relationship Initial Access Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
475 T1218 Signed Binary Proxy Execution Defense Evasion no
476 T1205 Traffic Signaling Defense Evasion|Persistence|Command And Control no
477 T1176 Browser Extensions Persistence Kimsuky|Stolen Pencil
478 T1175 Component Object Model and Distributed COM Lateral Movement|Execution no
479 T1187 Forced Authentication Credential Access DarkHydrus|Dragonfly 2.0
480 T1185 Man in the Browser Collection no
481 T1149 LC_MAIN Hijacking Defense Evasion no
482 T1134 Access Token Manipulation Defense Evasion|Privilege Escalation FIN6|Blue Mockingbird
483 T1136 Create Account Persistence no
484 T1137 Office Application Startup Persistence Gamaredon Group|APT32
485 T1140 Deobfuscate/Decode Files or Information Defense Evasion APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
486 T1135 Network Share Discovery Discovery Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
487 T1153 Source Execution no
488 T1133 External Remote Services Persistence|Initial Access APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
489 T1132 Data Encoding Command And Control no
490 T1129 Shared Modules Execution no
491 T1127 Trusted Developer Utilities Proxy Execution Defense Evasion no
492 T1125 Video Capture Collection Silence|FIN7
493 T1124 System Time Discovery Discovery Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
494 T1123 Audio Capture Collection APT37
495 T1120 Peripheral Device Discovery Discovery Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
496 T1119 Automated Collection Collection Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
497 T1115 Clipboard Data Collection Operation Wocao|APT39|APT38
498 T1114 Email Collection Collection Silent Librarian
499 T1113 Screen Capture Collection GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
500 T1112 Modify Registry Defense Evasion Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8
501 T1111 Two-Factor Authentication Interception Credential Access Chimera|Operation Wocao
502 T1110 Brute Force Credential Access APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
503 T1108 Redundant Access Defense Evasion|Persistence no
504 T1106 Native API Execution Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
505 T1105 Ingress Tool Transfer Command And Control HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
506 T1104 Multi-Stage Channels Command And Control APT41|MuddyWater|APT3
507 T1102 Web Service Command And Control Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
508 T1098 Account Manipulation Persistence APT3|Dragonfly 2.0|Lazarus Group
509 T1095 Non-Application Layer Protocol Command And Control HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
510 T1092 Communication Through Removable Media Command And Control APT28
511 T1091 Replication Through Removable Media Lateral Movement|Initial Access Mustang Panda|Tropic Trooper|Darkhotel|APT28
512 T1090 Proxy Command And Control Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
513 T1087 Account Discovery Discovery APT29|UNC2452
514 T1083 File and Directory Discovery Discovery APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
515 T1082 System Information Discovery Discovery APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
516 T1080 Taint Shared Content Lateral Movement Gamaredon Group|BRONZE BUTLER|Darkhotel
517 T1078 Valid Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
518 T1074 Data Staged Collection Wizard Spider
519 T1072 Software Deployment Tools Execution|Lateral Movement Silence|APT32|Threat Group-1314
520 T1071 Application Layer Protocol Command And Control Rocke|Magic Hound|Dragonfly 2.0
521 T1070 Indicator Removal on Host Defense Evasion APT29|UNC2452
522 T1069 Permission Groups Discovery Discovery APT29|UNC2452|TA505|APT3
523 T1068 Exploitation for Privilege Escalation Privilege Escalation ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
524 T1064 Scripting Defense Evasion|Execution no
525 T1062 Hypervisor Persistence no
526 T1061 Graphical User Interface Execution no
527 T1059 Command and Scripting Interpreter Execution Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
528 T1057 Process Discovery Discovery APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
529 T1056 Input Capture Collection|Credential Access APT39
530 T1055 Process Injection Defense Evasion|Privilege Escalation Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
531 T1053 Scheduled Task/Job Execution|Persistence|Privilege Escalation no
532 T1052 Exfiltration Over Physical Medium Exfiltration no
533 T1051 Shared Webroot Lateral Movement no
534 T1049 System Network Connections Discovery Discovery Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
535 T1048 Exfiltration Over Alternative Protocol Exfiltration no
536 T1047 Windows Management Instrumentation Execution Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
537 T1046 Network Service Scanning Discovery Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
538 T1043 Commonly Used Port Command And Control OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
539 T1041 Exfiltration Over C2 Channel Exfiltration ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
540 T1040 Network Sniffing Credential Access|Discovery Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
541 T1039 Data from Network Shared Drive Collection Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass
542 T1037 Boot or Logon Initialization Scripts Persistence|Privilege Escalation Rocke
543 T1036 Masquerading Defense Evasion APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
544 T1034 Path Interception Persistence|Privilege Escalation no
545 T1033 System Owner/User Discovery Discovery Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
546 T1030 Data Transfer Size Limits Exfiltration Threat Group-3390
547 T1029 Scheduled Transfer Exfiltration Higaisa
548 T1027 Obfuscated Files or Information Defense Evasion APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
549 T1026 Multiband Communication Command And Control Lazarus Group
550 T1025 Data from Removable Media Collection Turla|Gamaredon Group|APT28
551 T1021 Remote Services Lateral Movement no
552 T1020 Automated Exfiltration Exfiltration Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
553 T1018 Remote System Discovery Discovery APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
554 T1016 System Network Configuration Discovery Discovery ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
555 T1014 Rootkit Defense Evasion Rocke|APT41|APT28|Winnti Group
556 T1012 Query Registry Discovery ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
557 T1011 Exfiltration Over Other Network Medium Exfiltration no
558 T1010 Application Window Discovery Discovery Lazarus Group
559 T1008 Fallback Channels Command And Control Carbanak|APT41|OilRig|Lazarus Group
560 T1007 System Service Discovery Discovery Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
561 T1006 Direct Volume Access Defense Evasion no
562 T1005 Data from Local System Collection APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
563 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
564 T1001 Data Obfuscation Command And Control Operation Wocao|Axiom
dist/devsecops/lookups/network_acl_activity_baseline.csv
Vendored
+1
View File
@@ -0,0 +1 @@
arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls
1 arn latestCount numDataPoints avgApiCalls stdevApiCalls
dist/devsecops/lookups/previously_seen_S3_access_from_remote_ip.csv
Vendored
+1
View File
@@ -0,0 +1 @@
bucket_name,remote_ip,earliest,latest
1 bucket_name remote_ip earliest latest
dist/devsecops/lookups/previously_seen_api_calls_from_user_roles.csv
Vendored
+1
View File
@@ -0,0 +1 @@
earliest,latest,userName,eventName
1 earliest latest userName eventName
dist/devsecops/lookups/previously_seen_aws_cross_account_activity.csv
Vendored
+1
View File
@@ -0,0 +1 @@
firstTime,lastTime,requestingAccountId,requestedAccountId
1 firstTime lastTime requestingAccountId requestedAccountId
dist/devsecops/lookups/previously_seen_aws_regions.csv
Vendored
+1
View File
@@ -0,0 +1 @@
earliest,latest,awsRegion
1 earliest latest awsRegion
dist/devsecops/lookups/previously_seen_cmd_line_arguments.csv
Vendored
+1
View File
@@ -0,0 +1 @@
firstTime,lastTime,process
1 firstTime lastTime process
dist/devsecops/lookups/previously_seen_ec2_modifications_by_user.csv
Vendored
+1
View File
@@ -0,0 +1 @@
arn,firstTime,lastTime
1 arn firstTime lastTime
dist/devsecops/lookups/prohibited_apps_launching_cmd.csv
Vendored
+17
View File
@@ -0,0 +1,17 @@
prohibited_applications,isProhibited
winword.exe,prohibited
EXCEL.EXE,prohibited
OUTLOOK.EXE,prohibited
POWERPNT.EXE,prohibited
visio.exe,prohibited
mspub.exe,prohibited
Acrobat.exe,prohibited
Acrord32.exe,prohibited
chrome.exe,prohibited
iexplore.exe,prohibited
opera.exe,prohibited
firefox.exe,prohibited
java.exe,prohibited
powershell.exe,prohibited
mshta.exe, prohibited
zoom.exe,prohibitied
1 prohibited_applications isProhibited
2 winword.exe prohibited
3 EXCEL.EXE prohibited
4 OUTLOOK.EXE prohibited
5 POWERPNT.EXE prohibited
6 visio.exe prohibited
7 mspub.exe prohibited
8 Acrobat.exe prohibited
9 Acrord32.exe prohibited
10 chrome.exe prohibited
11 iexplore.exe prohibited
12 opera.exe prohibited
13 firefox.exe prohibited
14 java.exe prohibited
15 powershell.exe prohibited
16 mshta.exe prohibited
17 zoom.exe prohibitied
dist/devsecops/lookups/prohibited_processes.csv
Vendored
+20
View File
@@ -0,0 +1,20 @@
app,note
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
nc.exe,ESCU - This process is an open source tool used for network communications.
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
1 app note
2 remcom.exe ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
3 pwdump.exe ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
4 pwdump2.exe ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
5 nc.exe ESCU - This process is an open source tool used for network communications.
6 wce.exe ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
7 cain.exe ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
8 nmap.exe ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
9 kidlogger.exe ESCU - This process is associated with a tool used to collect keyboard input on a host.
10 isass.exe ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
11 svch0st.exe ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
12 at.exe ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
13 getmail.exe ESCU - This process is seen to be used by attackers to extract email files from host machines.
14 ntdll.exe ESCU - This process was identified as malicious by DHS Alert TA18-074A.
15 netpass.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
16 WebBrowserPassView.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
17 OutlookAddressBookView.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
18 mailpv.exe ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
19 NLBrute.exe ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
20 selfdel.exe ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
dist/devsecops/lookups/prohibited_softwares.csv
Vendored
+20
View File
@@ -0,0 +1,20 @@
app,note
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
nc.exe,ESCU - This process is an open source tool used for network communications.
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
1 app note
2 remcom.exe ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
3 pwdump.exe ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
4 pwdump2.exe ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
5 nc.exe ESCU - This process is an open source tool used for network communications.
6 wce.exe ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
7 cain.exe ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
8 nmap.exe ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
9 kidlogger.exe ESCU - This process is associated with a tool used to collect keyboard input on a host.
10 isass.exe ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
11 svch0st.exe ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
12 at.exe ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
13 getmail.exe ESCU - This process is seen to be used by attackers to extract email files from host machines.
14 ntdll.exe ESCU - This process was identified as malicious by DHS Alert TA18-074A.
15 netpass.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
16 WebBrowserPassView.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
17 OutlookAddressBookView.exe ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
18 mailpv.exe ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
19 NLBrute.exe ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
20 selfdel.exe ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
dist/devsecops/lookups/ransomware_extensions.csv
Vendored
+299
View File
@@ -0,0 +1,299 @@
Extensions,Name
.enc,.CryptoHasYou.
.777,777
.R4A,7ev3n
.R5A,7ev3n
.7h9r,7h9r
.8lock8,8lock8
.encrypt,Alpha Ransomware
.amba,AMBA
.adk,Angry Duck
.encrypted,Apocalypse
.SecureCrypted,Apocalypse
.FuckYourData,Apocalypse
.unavailable,Apocalypse
.bleepYourFiles,Apocalypse
.Where_my_files.txt,Apocalypse
.encrypted,ApocalypseVM
.locked,ApocalypseVM
.locky,AutoLocky
.adr,BaksoCrypt
.bart.zip,Bart
.bart,Bart
.perl,Bart
.clf,BitCryptor
.bitstak,BitStak
.Silent,BlackShades Crypter
.blocatto,Blocatto
.lock,Brazilian
.cry,Central Security Treatment Organization
.cerber,Cerber
.cerber2,Cerber
.cerber3,Cerber
.clf,CoinVault
.coverton,Coverton
.enigma,Coverton
.czvxce,Coverton
.criptiko,CryFile
.criptoko,CryFile
.criptokod,CryFile
.cripttt,CryFile
.aga,CryFile
.cry,CryLocker
.ENCRYPTED,Crypren
.crypt38,Crypt38
.scl,CryptFIle2
.crinf,CryptInfinite
.frtrss,CryptoFortress
.clf,CryptoGraphic Locker
.crjoker,CryptoJoker
.encrypted ,CryptoLocker
.ENC,CryptoLocker
.code,CryptoMix
.scl,CryptoMix
.crptrgr,CryptoRoger
.locked,CryptoShocker
.CryptoTorLocker2015!,CryptoTorLocker2015
.crypt,CryptXXX
.crypt,CryptXXX 2.0
.crypt,CryptXXX 3.0
.cryp1,CryptXXX 3.0
.crypz,CryptXXX 3.0
.cryptz,CryptXXX 3.0
.cryp1,CryptXXX 3.1
.ctbl,CTB-Locker
.encrypted,CuteRansomware
.ded,DEDCryptor
.domino,Domino
.locked,EDA2 / HiddenTear
.isis,EduCrypt
.locked,EduCrypt
.ha3,El-Polocker
.enigma,Enigma
.1txt,Enigma
.exotic,Exotic
.locked,Fakben
.fantom,Fantom
.Z81928819,GhostCrypt
.purge,Globe v1
.globe,Globe v3
.locked,GNL Locker
.crypt,Gomasom
.herbst,Herbst
.cry,Hi Buddy!
.locky,Hucky
.crime,iLock
.crime,iLockLight
.btc,Jigsaw
.kkk,Jigsaw
.fun,Jigsaw
.gws,Jigsaw
.porno,Jigsaw
.payransom,Jigsaw
.payms,Jigsaw
.paymst,Jigsaw
.AFD,Jigsaw
.paybtcs,Jigsaw
.epic,Jigsaw
.xyz,Jigsaw
.locked,Job Crypter
.encrypted,KeRanger
.keybtc@inbox_com,KeyBTC
.rip,Killer Locker
.kimcilware,KimcilWare
.locked,KimcilWare
.kostya,Kostya
.kratos,KratosCrypt
.LeChiffre,LeChiffre
.locky,Locky
.zepto,Locky
.odin,Locky
.shit,Locky
.thor,Locky
.asier,Locky
.zzzzz,Locky
.osiris,Locky
.lock93,Lock93
.crime,Lortok
.oor,LowLevel04
.magic,Magic
.Lock,MIRCOP
.fucked,MireWare
.fuck,MireWare
.locked,MM Locker
.KEYZ,Mobef
.KEYH0LES,Mobef
.crypted,Nemucod
.odcodc,ODCODC
.cbf,Offline ransomware
.LOL!,OMG! Ransomware
.OMG!,OMG! Ransomware
.padcrypt,PadCrypt
.locked,Philadelphia
.locked,PokemonGO
.filock,Popcorn Time
.locky,PowerWare
.crypt,R980
.locked,RAA encryptor
.RDM,Radamant
.RRK,Radamant
.RAD,Radamant
.RADAMANT,Radamant
.locked,Rakhni
.kraken,Rakhni
.darkness,Rakhni
.nochance,Rakhni
.oshit,Rakhni
.oplata@qq_com,Rakhni
.relock@qq_com,Rakhni
.crypto,Rakhni
.helpdecrypt@ukr.net,Rakhni
.pizda@qq_com,Rakhni
.dyatel@qq_com,Rakhni
._ryp,Rakhni
.nalog@qq_com,Rakhni
.chifrator@qq_com,Rakhni
.gruzin@qq_com,Rakhni
.troyancoder@qq_com,Rakhni
.encrypted,Rakhni
.cry,Rakhni
.AES256,Rakhni
.enc,Rakhni
.hb15,Rakhni
.vscrypt,Rector
.infected,Rector
.bloc,Rector
.korrektor,Rector
.rekt,RektLocker
.remind,RemindMe
.crashed,RemindMe
.rokku,Rokku
.encryptedAES,Samas-Samsam
.encryptedRSA,Samas-Samsam
.encedRSA,Samas-Samsam
.justbtcwillhelpyou,Samas-Samsam
.btcbtcbtc,Samas-Samsam
.btc-help-you,Samas-Samsam
.only-we_can-help_you,Samas-Samsam
.iwanthelpuuu,Samas-Samsam
.notfoundrans,Samas-Samsam
.encmywork,Samas-Samsam
.weapologize,Samas-Samsam
.stubbin,Samas-Samsam
.areyoulovemyrans,Samas-Samsam
.loveransisgood,Samas-Samsam
.myransext2017,Samas-Samsam
.disposed2017,Samas-Samsam
.prosperous666,Samas-Samsam
.supported2017,Samas-Samsam
.country82000,Samas-Samsam
.moments2900,Samas-Samsam
.breeding123,Samas-Samsam
.mention9823,Samas-Samsam
.suppose666,Samas-Samsam
.skjdthghh,Samas-Samsam
.cifgksaffsfyghd,Samas-Samsam
.iaufkakfhsaraf,Samas-Samsam
.filegofprencrp,Samas-Samsam
.weencedufiles,Samas-Samsam
.encryptedyourfiles,Samas-Samsam
.letmetrydecfiles,Samas-Samsam
.otherinformation,Samas-Samsam
.weareyourfriends,Samas-Samsam
.noproblemwedecfiles,Samas-Samsam
.powerfulldecrypt,Samas-Samsam
.wowreadfordecryp,Samas-Samsam
.wowwhereismyfiles,Samas-Samsam
.helpmeencedfiles,Samas-Samsam
.theworldisyours,Samas-Samsam
.vekanhelpu,Samas-Samsam
.howcanihelpusir,Samas-Samsam
.VforVendetta,Samas-Samsam
.checkdiskenced,Samas-Samsam
.goforhelp,Samas-Samsam
.iloveworld,Samas-Samsam
.canihelpyou,Samas-Samsam
.AreYouLoveMyRansFile,Samas-Samsam
.fucku,Samas-Samsam
.happenencedfiles,Samas-Samsam
.iwishiyou,Samas-Samsam
.powerfulldecryp,Samas-Samsam
.suppose665,Samas-Samsam
.Whereisyourfiles,Samas-Samsam
.sanction,Sanction
.locked,Shark
.shino,ShinoLocker
.locked,SkidLocker / Pompous
.encrypted,Smrss32
.RSNSlocked,SNSLocker
.RSplited,SNSLocker
.sport,Sport
.locked,Stampado
.locked,Strictor
.surprise,Surprise
.tzu,Surprise
.szf,SZFLocker
.xcri,TeleCrypt
.vvv,TeslaCrypt 0.x - 2.2.0
.ecc,TeslaCrypt 0.x - 2.2.0
.exx,TeslaCrypt 0.x - 2.2.0
.ezz,TeslaCrypt 0.x - 2.2.0
.abc,TeslaCrypt 0.x - 2.2.0
.aaa,TeslaCrypt 0.x - 2.2.0
.zzz,TeslaCrypt 0.x - 2.2.0
.xyz,TeslaCrypt 0.x - 2.2.0
.micro,TeslaCrypt 3.0+
.xxx,TeslaCrypt 3.0+
.ttt,TeslaCrypt 3.0+
.mp3,TeslaCrypt 3.0+
.Encrypted,TorrentLocker
.enc,TorrentLocker
.toxcrypt,Toxcrypt
.better_call_saul,Troldesh
.xtbl,Troldesh
.da_vinci_code,Troldesh
.windows10,Troldesh
.enc,TrueCrypter
.locked,Turkish Ransom
.H3LL,Ungluk
.0x0,Ungluk
.1999,Ungluk
.CRRRT,Unlock92
.CCCRRRPPP,Unlock92
.vault,VaultCrypt
.xort,VaultCrypt
.trun,VaultCrypt
.Venusf,VenusLocker
.Venusp,VenusLocker
.CrySiS,Virus-Encoder
.xtbl,Virus-Encoder
.wflx,WildFire Locker
.EnCiPhErEd,Xorist
.73i87A,Xorist
.p5tkjw,Xorist
.PoAr2w,Xorist
.fileiscryptedhard,Xorist
.encoderpass,Xorist
.zc3791,Xorist
.xrtn,XRTN
.zcrypt,Zcrypt
.crypto,Zimbra
.vault,Zlader / Russian
.zyklon,Zyklon
.wncry,WannaCry
.wcry,WannaCry
.wnry,WannaCry
.wncryt,WannaCry
.WNCRYT,WannaCry
.RYK,Ryuk
.Clop,Clop
.Cllp,Clop
.JSWORM,JSWorm
.NEMTY_*,Nemty
.NEFILIM,Nefilim
.OFFWHITE,Offwhite
.TELEGRAM,Telegram
.FUSION,Fusion
.MILIHPEN,Milihpen
.GANGBANG,Gangbang
.reddot,RedDot
1 Extensions Name
2 .enc .CryptoHasYou.
3 .777 777
4 .R4A 7ev3n
5 .R5A 7ev3n
6 .7h9r 7h9r
7 .8lock8 8lock8
8 .encrypt Alpha Ransomware
9 .amba AMBA
10 .adk Angry Duck
11 .encrypted Apocalypse
12 .SecureCrypted Apocalypse
13 .FuckYourData Apocalypse
14 .unavailable Apocalypse
15 .bleepYourFiles Apocalypse
16 .Where_my_files.txt Apocalypse
17 .encrypted ApocalypseVM
18 .locked ApocalypseVM
19 .locky AutoLocky
20 .adr BaksoCrypt
21 .bart.zip Bart
22 .bart Bart
23 .perl Bart
24 .clf BitCryptor
25 .bitstak BitStak
26 .Silent BlackShades Crypter
27 .blocatto Blocatto
28 .lock Brazilian
29 .cry Central Security Treatment Organization
30 .cerber Cerber
31 .cerber2 Cerber
32 .cerber3 Cerber
33 .clf CoinVault
34 .coverton Coverton
35 .enigma Coverton
36 .czvxce Coverton
37 .criptiko CryFile
38 .criptoko CryFile
39 .criptokod CryFile
40 .cripttt CryFile
41 .aga CryFile
42 .cry CryLocker
43 .ENCRYPTED Crypren
44 .crypt38 Crypt38
45 .scl CryptFIle2
46 .crinf CryptInfinite
47 .frtrss CryptoFortress
48 .clf CryptoGraphic Locker
49 .crjoker CryptoJoker
50 .encrypted CryptoLocker
51 .ENC CryptoLocker
52 .code CryptoMix
53 .scl CryptoMix
54 .crptrgr CryptoRoger
55 .locked CryptoShocker
56 .CryptoTorLocker2015! CryptoTorLocker2015
57 .crypt CryptXXX
58 .crypt CryptXXX 2.0
59 .crypt CryptXXX 3.0
60 .cryp1 CryptXXX 3.0
61 .crypz CryptXXX 3.0
62 .cryptz CryptXXX 3.0
63 .cryp1 CryptXXX 3.1
64 .ctbl CTB-Locker
65 .encrypted CuteRansomware
66 .ded DEDCryptor
67 .domino Domino
68 .locked EDA2 / HiddenTear
69 .isis EduCrypt
70 .locked EduCrypt
71 .ha3 El-Polocker
72 .enigma Enigma
73 .1txt Enigma
74 .exotic Exotic
75 .locked Fakben
76 .fantom Fantom
77 .Z81928819 GhostCrypt
78 .purge Globe v1
79 .globe Globe v3
80 .locked GNL Locker
81 .crypt Gomasom
82 .herbst Herbst
83 .cry Hi Buddy!
84 .locky Hucky
85 .crime iLock
86 .crime iLockLight
87 .btc Jigsaw
88 .kkk Jigsaw
89 .fun Jigsaw
90 .gws Jigsaw
91 .porno Jigsaw
92 .payransom Jigsaw
93 .payms Jigsaw
94 .paymst Jigsaw
95 .AFD Jigsaw
96 .paybtcs Jigsaw
97 .epic Jigsaw
98 .xyz Jigsaw
99 .locked Job Crypter
100 .encrypted KeRanger
101 .keybtc@inbox_com KeyBTC
102 .rip Killer Locker
103 .kimcilware KimcilWare
104 .locked KimcilWare
105 .kostya Kostya
106 .kratos KratosCrypt
107 .LeChiffre LeChiffre
108 .locky Locky
109 .zepto Locky
110 .odin Locky
111 .shit Locky
112 .thor Locky
113 .asier Locky
114 .zzzzz Locky
115 .osiris Locky
116 .lock93 Lock93
117 .crime Lortok
118 .oor LowLevel04
119 .magic Magic
120 .Lock MIRCOP
121 .fucked MireWare
122 .fuck MireWare
123 .locked MM Locker
124 .KEYZ Mobef
125 .KEYH0LES Mobef
126 .crypted Nemucod
127 .odcodc ODCODC
128 .cbf Offline ransomware
129 .LOL! OMG! Ransomware
130 .OMG! OMG! Ransomware
131 .padcrypt PadCrypt
132 .locked Philadelphia
133 .locked PokemonGO
134 .filock Popcorn Time
135 .locky PowerWare
136 .crypt R980
137 .locked RAA encryptor
138 .RDM Radamant
139 .RRK Radamant
140 .RAD Radamant
141 .RADAMANT Radamant
142 .locked Rakhni
143 .kraken Rakhni
144 .darkness Rakhni
145 .nochance Rakhni
146 .oshit Rakhni
147 .oplata@qq_com Rakhni
148 .relock@qq_com Rakhni
149 .crypto Rakhni
150 .helpdecrypt@ukr.net Rakhni
151 .pizda@qq_com Rakhni
152 .dyatel@qq_com Rakhni
153 ._ryp Rakhni
154 .nalog@qq_com Rakhni
155 .chifrator@qq_com Rakhni
156 .gruzin@qq_com Rakhni
157 .troyancoder@qq_com Rakhni
158 .encrypted Rakhni
159 .cry Rakhni
160 .AES256 Rakhni
161 .enc Rakhni
162 .hb15 Rakhni
163 .vscrypt Rector
164 .infected Rector
165 .bloc Rector
166 .korrektor Rector
167 .rekt RektLocker
168 .remind RemindMe
169 .crashed RemindMe
170 .rokku Rokku
171 .encryptedAES Samas-Samsam
172 .encryptedRSA Samas-Samsam
173 .encedRSA Samas-Samsam
174 .justbtcwillhelpyou Samas-Samsam
175 .btcbtcbtc Samas-Samsam
176 .btc-help-you Samas-Samsam
177 .only-we_can-help_you Samas-Samsam
178 .iwanthelpuuu Samas-Samsam
179 .notfoundrans Samas-Samsam
180 .encmywork Samas-Samsam
181 .weapologize Samas-Samsam
182 .stubbin Samas-Samsam
183 .areyoulovemyrans Samas-Samsam
184 .loveransisgood Samas-Samsam
185 .myransext2017 Samas-Samsam
186 .disposed2017 Samas-Samsam
187 .prosperous666 Samas-Samsam
188 .supported2017 Samas-Samsam
189 .country82000 Samas-Samsam
190 .moments2900 Samas-Samsam
191 .breeding123 Samas-Samsam
192 .mention9823 Samas-Samsam
193 .suppose666 Samas-Samsam
194 .skjdthghh Samas-Samsam
195 .cifgksaffsfyghd Samas-Samsam
196 .iaufkakfhsaraf Samas-Samsam
197 .filegofprencrp Samas-Samsam
198 .weencedufiles Samas-Samsam
199 .encryptedyourfiles Samas-Samsam
200 .letmetrydecfiles Samas-Samsam
201 .otherinformation Samas-Samsam
202 .weareyourfriends Samas-Samsam
203 .noproblemwedecfiles Samas-Samsam
204 .powerfulldecrypt Samas-Samsam
205 .wowreadfordecryp Samas-Samsam
206 .wowwhereismyfiles Samas-Samsam
207 .helpmeencedfiles Samas-Samsam
208 .theworldisyours Samas-Samsam
209 .vekanhelpu Samas-Samsam
210 .howcanihelpusir Samas-Samsam
211 .VforVendetta Samas-Samsam
212 .checkdiskenced Samas-Samsam
213 .goforhelp Samas-Samsam
214 .iloveworld Samas-Samsam
215 .canihelpyou Samas-Samsam
216 .AreYouLoveMyRansFile Samas-Samsam
217 .fucku Samas-Samsam
218 .happenencedfiles Samas-Samsam
219 .iwishiyou Samas-Samsam
220 .powerfulldecryp Samas-Samsam
221 .suppose665 Samas-Samsam
222 .Whereisyourfiles Samas-Samsam
223 .sanction Sanction
224 .locked Shark
225 .shino ShinoLocker
226 .locked SkidLocker / Pompous
227 .encrypted Smrss32
228 .RSNSlocked SNSLocker
229 .RSplited SNSLocker
230 .sport Sport
231 .locked Stampado
232 .locked Strictor
233 .surprise Surprise
234 .tzu Surprise
235 .szf SZFLocker
236 .xcri TeleCrypt
237 .vvv TeslaCrypt 0.x - 2.2.0
238 .ecc TeslaCrypt 0.x - 2.2.0
239 .exx TeslaCrypt 0.x - 2.2.0
240 .ezz TeslaCrypt 0.x - 2.2.0
241 .abc TeslaCrypt 0.x - 2.2.0
242 .aaa TeslaCrypt 0.x - 2.2.0
243 .zzz TeslaCrypt 0.x - 2.2.0
244 .xyz TeslaCrypt 0.x - 2.2.0
245 .micro TeslaCrypt 3.0+
246 .xxx TeslaCrypt 3.0+
247 .ttt TeslaCrypt 3.0+
248 .mp3 TeslaCrypt 3.0+
249 .Encrypted TorrentLocker
250 .enc TorrentLocker
251 .toxcrypt Toxcrypt
252 .better_call_saul Troldesh
253 .xtbl Troldesh
254 .da_vinci_code Troldesh
255 .windows10 Troldesh
256 .enc TrueCrypter
257 .locked Turkish Ransom
258 .H3LL Ungluk
259 .0x0 Ungluk
260 .1999 Ungluk
261 .CRRRT Unlock92
262 .CCCRRRPPP Unlock92
263 .vault VaultCrypt
264 .xort VaultCrypt
265 .trun VaultCrypt
266 .Venusf VenusLocker
267 .Venusp VenusLocker
268 .CrySiS Virus-Encoder
269 .xtbl Virus-Encoder
270 .wflx WildFire Locker
271 .EnCiPhErEd Xorist
272 .73i87A Xorist
273 .p5tkjw Xorist
274 .PoAr2w Xorist
275 .fileiscryptedhard Xorist
276 .encoderpass Xorist
277 .zc3791 Xorist
278 .xrtn XRTN
279 .zcrypt Zcrypt
280 .crypto Zimbra
281 .vault Zlader / Russian
282 .zyklon Zyklon
283 .wncry WannaCry
284 .wcry WannaCry
285 .wnry WannaCry
286 .wncryt WannaCry
287 .WNCRYT WannaCry
288 .RYK Ryuk
289 .Clop Clop
290 .Cllp Clop
291 .JSWORM JSWorm
292 .NEMTY_* Nemty
293 .NEFILIM Nefilim
294 .OFFWHITE Offwhite
295 .TELEGRAM Telegram
296 .FUSION Fusion
297 .MILIHPEN Milihpen
298 .GANGBANG Gangbang
299 .reddot RedDot
dist/devsecops/lookups/ransomware_notes.csv
Vendored
+69
View File
@@ -0,0 +1,69 @@
ransomware_notes, status
HELP_TO_SAVE_FILES.txt,True
BitCryptorFileList.txt,True
BUYUNLOCKCODE,True
YOUR_FILES_ARE_ENCRYPTED.HTML,True
Coin.Locker.txt,True
DECRYPT_INSTRUCTIONS.HTML,True
ReadDecryptFilesHere.txt,True
HOW_DECRYPT.TXT,True
READ IF YOU WANT YOUR FILES BACK.HTML,True
GetYouFiles.txt,True
HOW TO DECRYPT FILES.HTML,True
DECRYPT_INSTRUCTION.TXT,True
HELP_DECRYPT.TXT,True
HELP_YOURFILES.HTML,True
HowDecrypt.gif,True
Decrypt All Files *.bmp,True
cryptinfo.txt,True
DECRYPT_Readme.TXT.ReadMe,True
qwer.html,True
qwer2.html,True
Hellothere.txt,True
FILESAREGONE.TXT,True
HOW TO DECRYPT FILES.TXT,True
DECRYPT_Readme.TXT.ReadMe,True
README_DECRYPT_HYDRA_ID_*.txt,True
DECRYPT_YOUR_FILES.HTML,True
KryptoLocker_README.txt,True
_Locky_recover_instructions.txt,True
DECRYPT_Readme.TXT.ReadMe,True
ATTENTION.RTF,True
how to get data.txt,True
IMPORTANT READ ME.txt,True
UnblockFiles.vbs,True
YOUR_FILES.url,True
exit.hhr.obleep,True
HOW_TO_DECRYPT.HTML,True
HOW-TO-DECRYPT-FILES.HTML,True
HELP_TO_SAVE_FILES.txt,True
HELP_TO_SAVE_FILES.txt,True
HELP_TO_SAVE_FILES.txt,True
_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt,True
DECRYPT_INSTRUCTIONS.HTML,True
README_DECRYPT_UMBRE_ID_*.txt,True
Help_Decrypt.txt,True
CryptLogFile.txt,True
*@Please_Read_Me@.txt*,True
*@WanaDecryptor@.exe*,True
# DECRYPT MY FILES #.vbs,True
# DECRYPT MY FILES #.html,True
# DECRYPT MY FILES #.txt,True
# DECRYPT MY FILES #.vbs,True
# DECRYPT MY FILES #.html,True
# DECRYPT MY FILES #.txt,True
HELP_DECRYPT_YOUR_FILES.HTML,True
*-HELP_FOR_DECRYPT_FILE.html,True
*-SORRY-FOR-FILES.html,True
*-READ-FOR-HELLPP.html,True
RyukReadMe.html,True
ClopReadMe.txt,True
README_README.txt,True
JSWORM-DECRYPT.html,True
NEMTY_*-DECRYPT.txt,True
NEFILIM-DECRYPT.txt,True
OFFWHITE-MANUAL.txt,True
TELEGRAM-RECOVER.txt,True
FUSION-README.txt,True
MILIHPEN-INSTRUCT.txt,True
GANGBANG-NOTE.txt,True
1 ransomware_notes status
2 HELP_TO_SAVE_FILES.txt True
3 BitCryptorFileList.txt True
4 BUYUNLOCKCODE True
5 YOUR_FILES_ARE_ENCRYPTED.HTML True
6 Coin.Locker.txt True
7 DECRYPT_INSTRUCTIONS.HTML True
8 ReadDecryptFilesHere.txt True
9 HOW_DECRYPT.TXT True
10 READ IF YOU WANT YOUR FILES BACK.HTML True
11 GetYouFiles.txt True
12 HOW TO DECRYPT FILES.HTML True
13 DECRYPT_INSTRUCTION.TXT True
14 HELP_DECRYPT.TXT True
15 HELP_YOURFILES.HTML True
16 HowDecrypt.gif True
17 Decrypt All Files *.bmp True
18 cryptinfo.txt True
19 DECRYPT_Readme.TXT.ReadMe True
20 qwer.html True
21 qwer2.html True
22 Hellothere.txt True
23 FILESAREGONE.TXT True
24 HOW TO DECRYPT FILES.TXT True
25 DECRYPT_Readme.TXT.ReadMe True
26 README_DECRYPT_HYDRA_ID_*.txt True
27 DECRYPT_YOUR_FILES.HTML True
28 KryptoLocker_README.txt True
29 _Locky_recover_instructions.txt True
30 DECRYPT_Readme.TXT.ReadMe True
31 ATTENTION.RTF True
32 how to get data.txt True
33 IMPORTANT READ ME.txt True
34 UnblockFiles.vbs True
35 YOUR_FILES.url True
36 exit.hhr.obleep True
37 HOW_TO_DECRYPT.HTML True
38 HOW-TO-DECRYPT-FILES.HTML True
39 HELP_TO_SAVE_FILES.txt True
40 HELP_TO_SAVE_FILES.txt True
41 HELP_TO_SAVE_FILES.txt True
42 _H_e_l_p_RECOVER_INSTRUCTIONS+*.txt True
43 DECRYPT_INSTRUCTIONS.HTML True
44 README_DECRYPT_UMBRE_ID_*.txt True
45 Help_Decrypt.txt True
46 CryptLogFile.txt True
47 *@Please_Read_Me@.txt* True
48 *@WanaDecryptor@.exe* True
49 # DECRYPT MY FILES #.vbs True
50 # DECRYPT MY FILES #.html True
51 # DECRYPT MY FILES #.txt True
52 # DECRYPT MY FILES #.vbs True
53 # DECRYPT MY FILES #.html True
54 # DECRYPT MY FILES #.txt True
55 HELP_DECRYPT_YOUR_FILES.HTML True
56 *-HELP_FOR_DECRYPT_FILE.html True
57 *-SORRY-FOR-FILES.html True
58 *-READ-FOR-HELLPP.html True
59 RyukReadMe.html True
60 ClopReadMe.txt True
61 README_README.txt True
62 JSWORM-DECRYPT.html True
63 NEMTY_*-DECRYPT.txt True
64 NEFILIM-DECRYPT.txt True
65 OFFWHITE-MANUAL.txt True
66 TELEGRAM-RECOVER.txt True
67 FUSION-README.txt True
68 MILIHPEN-INSTRUCT.txt True
69 GANGBANG-NOTE.txt True
dist/devsecops/lookups/rare_process_allow_list_default.csv
Vendored
+7
View File
@@ -0,0 +1,7 @@
process,allow_list
splunk-regmon.exe,true
winword.exe,true
excel.exe,true
outlook.exe,true
powerpnt.exe,true
visio.exe,true
1 process allow_list
2 splunk-regmon.exe true
3 winword.exe true
4 excel.exe true
5 outlook.exe true
6 powerpnt.exe true
7 visio.exe true
dist/devsecops/lookups/rare_process_allow_list_local.csv
Vendored
+1
View File
@@ -0,0 +1 @@
process,allow_list
1 process allow_list
dist/devsecops/lookups/s3_deletion_baseline.csv
Vendored
+1
View File
@@ -0,0 +1 @@
arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
1 arn latestCount numDataPoints avgApiCalls stdevApiCalls
dist/devsecops/lookups/security_group_activity_baseline.csv
Vendored
+1
View File
@@ -0,0 +1 @@
arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls
1 arn latestCount numDataPoints avgApiCalls stdevApiCalls
dist/devsecops/lookups/security_services.csv
Vendored
+5
View File
@@ -0,0 +1,5 @@
service,description,category
*mpssvc*,Windows Firewall Service,security
*wscsvc*,Windows Security Center Service,securty
*windefend*,Windows Defender Service,security
*sysmon*,Sysmon Driver,security
1 service description category
2 *mpssvc* Windows Firewall Service security
3 *wscsvc* Windows Security Center Service securty
4 *windefend* Windows Defender Service security
5 *sysmon* Sysmon Driver security
dist/devsecops/lookups/suspicious_files.csv
Vendored
+4
View File
@@ -0,0 +1,4 @@
file, note
mssscardprv.ax,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
scardprv.dll,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
wmmvsvc.dll,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
1 file note
2 mssscardprv.ax ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
3 scardprv.dll ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
4 wmmvsvc.dll ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
dist/devsecops/lookups/uncommon_processes_default.csv
Vendored
+9
View File
@@ -0,0 +1,9 @@
process_name,uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default
sethc.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
utilman.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
osk.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
magnify.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
narrator.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
displayswitch.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
atbroker.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
quser.exe,true,,DHS Report TA18-074A|Unusual Processes,Actions on Objectives,Execution
1 process_name uncommon_default category_default analytic_story_default kill_chain_phase_default mitre_attack_default
2 sethc.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
3 utilman.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
4 osk.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
5 magnify.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
6 narrator.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
7 displayswitch.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
8 atbroker.exe true needs_accessibility Windows Privilege Escalation Actions on Objectives Execution|Accessibility Features
9 quser.exe true DHS Report TA18-074A|Unusual Processes Actions on Objectives Execution
dist/devsecops/lookups/uncommon_processes_local.csv
Vendored
+1
View File
@@ -0,0 +1 @@
process_name,uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local
1 process_name uncommon_local category_local analytic_story_local kill_chain_phase_local mitre_attack_local
dist/devsecops/metadata/default.meta
Vendored
+35
View File
@@ -0,0 +1,35 @@
# Application-level permissions
[]
access = read : [ * ], write : [ admin, power ]
### EVENT TYPES
[eventtypes]
export = system
### PROPS
[props]
export = system
### TRANSFORMS
[transforms]
export = system
### LOOKUPS
[lookups]
export = system
### VIEWSTATES: even normal users should be able to create shared viewstates
[viewstates]
access = read : [ * ], write : [ * ]
export = system
lookups/images_to_repository.csv
+3
View File
@@ -0,0 +1,3 @@
image, repository
devsecops/cat_dog_client, splunk/devsecops_poc
devsecops/cat_dog_server, splunk/devsecops_poc
1 image repository
2 devsecops/cat_dog_client splunk/devsecops_poc
3 devsecops/cat_dog_server splunk/devsecops_poc
lookups/images_to_repository.yml
+3
View File
@@ -0,0 +1,3 @@
description: Mapping images to repositories
filename: images_to_repository.csv
name: images_to_repository
macros/signals.yml
+4
View File
@@ -0,0 +1,4 @@
definition: index=signals
description: customer specific splunk configurations(eg- index, source, sourcetype).
Replace the macro definition with configurations for your Splunk Environmnent.
name: signals

Some files were not shown because too many files have changed in this diff Show More