From 99829330c110577a0994acd3ee3c83601a1bb353 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 16 Mar 2022 13:35:48 -0700 Subject: [PATCH 1/6] all the changes again --- .../contentctl_core/domain/entities/baseline.py | 4 ++-- .../contentctl_core/domain/entities/detection.py | 4 ++-- ...tes_azure_active_service_accounts_by_pod_namespace.yml} | 4 ++-- ...ml => suspicious_powershell_command_line_arguments.yml} | 4 ++-- ... => excessive_distinct_processes_from_windows_temp.yml} | 4 ++-- ...l_loading_dotnet_into_memory_via_reflection_filter.yml} | 4 ++-- ...ws_disabled_users_failing_to_authenticate_kerberos.yml} | 4 ++-- ...s_invalid_users_failed_authentication_via_kerberos.yml} | 4 ++-- ...dows_users_authenticate_using_explicit_credentials.yml} | 4 ++-- ...ox_replication_service_writing_active_server_pages.yml} | 4 ++-- ...xcessive_distinct_processes_from_windows_temp.test.yml} | 6 +++--- ...ell_loading_dotnet_into_memory_via_reflection.test.yml} | 6 +++--- ...sabled_users_failing_to_authenticate_kerberos.test.yml} | 7 +++---- ...alid_users_failed_authentication_via_kerberos.test.yml} | 7 +++---- ...users_authenticate_using_explicit_credentials.test.yml} | 6 +++--- 15 files changed, 35 insertions(+), 37 deletions(-) rename detections/deprecated/{kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml => kubernetes_azure_active_service_accounts_by_pod_namespace.yml} (87%) rename detections/deprecated/{malicious_powershell_process___multiple_suspicious_command_line_arguments.yml => suspicious_powershell_command_line_arguments.yml} (92%) rename detections/endpoint/{excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml => excessive_distinct_processes_from_windows_temp.yml} (92%) rename detections/endpoint/{powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml => powershell_loading_dotnet_into_memory_via_reflection_filter.yml} (95%) rename detections/endpoint/{multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml => windows_disabled_users_failing_to_authenticate_kerberos.yml} (94%) rename detections/endpoint/{multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml => windows_invalid_users_failed_authentication_via_kerberos.yml} (94%) rename detections/endpoint/{multiple_users_attempting_to_authenticate_using_explicit_credentials.yml => windows_users_authenticate_using_explicit_credentials.yml} (95%) rename detections/experimental/endpoint/{microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml => ms_exchange_mailbox_replication_service_writing_active_server_pages.yml} (95%) rename tests/endpoint/{excessive_number_of_distinct_processes_created_in_windows_temp_folder.test.yml => excessive_distinct_processes_from_windows_temp.test.yml} (61%) rename tests/endpoint/{powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml => powershell_loading_dotnet_into_memory_via_reflection.test.yml} (62%) rename tests/endpoint/{multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml => windows_disabled_users_failing_to_authenticate_kerberos.test.yml} (59%) rename tests/endpoint/{multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.test.yml => windows_invalid_users_failed_authentication_via_kerberos.test.yml} (59%) rename tests/endpoint/{multiple_users_attempting_to_authenticate_using_explicit_credentials.test.yml => windows_users_authenticate_using_explicit_credentials.test.yml} (60%) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/baseline.py b/bin/contentctl_project/contentctl_core/domain/entities/baseline.py index b2ceb88eea..cd0b5ee32d 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/baseline.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/baseline.py @@ -34,8 +34,8 @@ class Baseline(BaseModel, SecurityContentObject): @validator('name') def name_max_length(cls, v): - if len(v) > 75: - raise ValueError('name is longer then 75 chars: ' + v) + if len(v) > 67: + raise ValueError('name is longer then 67 chars: ' + v) return v @validator('name') diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index d4d07a831e..387f9afa43 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -54,8 +54,8 @@ class Detection(BaseModel, SecurityContentObject): @validator('name') def name_max_length(cls, v): - if len(v) > 75: - raise ValueError('name is longer then 75 chars: ' + v) + if len(v) > 67: + raise ValueError('name is longer then 67 chars: ' + v) return v @validator('name') diff --git a/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml similarity index 87% rename from detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml rename to detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml index 79085115b2..2b35792ff3 100644 --- a/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml +++ b/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml @@ -1,4 +1,4 @@ -name: Kubernetes Azure detect most active service accounts by pod namespace +name: Kubernetes Azure active service accounts by pod namespace id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 version: 1 date: '2020-05-26' @@ -11,7 +11,7 @@ search: '`kubernetes_azure` category=kube-audit | spath input=properties.log | s user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status - properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`' + properties.pod objectRef.namespace |`kubernetes_azure_active_service_accounts_by_pod_namespace_filter`' how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics known_false_positives: Not all service accounts interactions are malicious. Analyst diff --git a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml similarity index 92% rename from detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml rename to detections/deprecated/suspicious_powershell_command_line_arguments.yml index 0a97fc103a..ba0b5844f8 100644 --- a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -1,4 +1,4 @@ -name: Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments +name: Suspicious Powershell Command-Line Arguments id: 2cdb91d2-542c-497f-b252-be495e71f38c version: 6 date: '2021-01-19' @@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`' + search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `suspicious_powershell_command_line_arguments_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml similarity index 92% rename from detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml rename to detections/endpoint/excessive_distinct_processes_from_windows_temp.yml index 09fa80cb2f..0b98699990 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml @@ -1,4 +1,4 @@ -name: Excessive number of distinct processes created in Windows Temp folder +name: Excessive distinct processes from Windows Temp id: 23587b6a-c479-11eb-b671-acde48001122 version: 2 date: '2022-02-28' @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`' + | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml similarity index 95% rename from detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml rename to detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml index 9ea29e759e..40060f2165 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml @@ -1,4 +1,4 @@ -name: PowerShell Loading DotNET into Memory via System Reflection Assembly +name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 1 date: '2021-06-10' @@ -22,7 +22,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`' + | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml similarity index 94% rename from detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml rename to detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml index 3b69b3a954..a162d117a9 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml @@ -1,4 +1,4 @@ -name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos +name: Windows Disabled Users Failing To Authenticate Kerberos id: 98f22d82-9d62-11eb-9fcf-acde48001122 version: 1 date: '2021-04-14' @@ -31,7 +31,7 @@ search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` ' + | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml similarity index 94% rename from detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml rename to detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml index 3069cc3600..be417870e8 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml @@ -1,4 +1,4 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using Kerberos +name: Windows Invalid Users Failed Authentication via Kerberos id: 001266a6-9d5b-11eb-829b-acde48001122 version: 1 date: '2021-04-14' @@ -31,7 +31,7 @@ search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$ as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` ' + | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml similarity index 95% rename from detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml rename to detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml index dbbb14ea1c..cb8c3e8d19 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml @@ -1,4 +1,4 @@ -name: Multiple Users Attempting To Authenticate Using Explicit Credentials +name: Windows Users Authenticate Using Explicit Credentials id: e61918fa-9ca4-11eb-836c-acde48001122 version: 1 date: '2021-04-13' @@ -32,7 +32,7 @@ search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval So tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' + | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs diff --git a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/experimental/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml similarity index 95% rename from detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml rename to detections/experimental/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml index 8694624697..8b0a1bd702 100644 --- a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml +++ b/detections/experimental/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -1,4 +1,4 @@ -name: Microsoft Exchange Mailbox Replication service writing Active Server Pages +name: MS Exchange Mailbox Replication service writing Active Server Pages id: 985f322c-57a5-11ec-b9ac-acde48001122 version: 1 date: '2021-12-07' @@ -37,7 +37,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, - file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`' + file_path, process_name | `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/tests/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.test.yml b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml similarity index 61% rename from tests/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.test.yml rename to tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml index 693efb4d82..8711c1c859 100644 --- a/tests/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.test.yml +++ b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml @@ -1,7 +1,7 @@ -name: Excessive number of distinct processes created in Windows Temp folder Unit Test +name: Excessive distinct processes from Windows Temp Unit Test tests: -- name: Excessive number of distinct processes created in Windows Temp folder - file: endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +- name: Excessive distinct processes from Windows Temp + file: endpoint/excessive_distinct_processes_from_windows_temp.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml similarity index 62% rename from tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml index 39e389a1d1..da5bf70239 100644 --- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml +++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml @@ -1,7 +1,7 @@ -name: PowerShell Loading DotNET into Memory via System Reflection Assembly Unit Test +name: PowerShell Loading DotNET into Memory via Reflection Unit Test tests: -- name: PowerShell Loading DotNET into Memory via System Reflection Assembly - file: endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +- name: PowerShell Loading DotNET into Memory via Reflection + file: endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml similarity index 59% rename from tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml rename to tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml index 8aa074f0d4..292e3877c8 100644 --- a/tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml +++ b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml @@ -1,8 +1,7 @@ -name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos Unit - Test +name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test tests: -- name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - file: endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +- name: Windows Disabled Users Failing To Authenticate Using Kerberos + file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.test.yml b/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml similarity index 59% rename from tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.test.yml rename to tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml index 579a7a2e9c..3c321e9d4a 100644 --- a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.test.yml +++ b/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml @@ -1,8 +1,7 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using Kerberos Unit - Test +name: Windows Invalid Users Failed Authentication via Kerberos Unit Test tests: -- name: Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - file: endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +- name: Windows Invalid Users Failed Authentication via Kerberos + file: endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.test.yml b/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml similarity index 60% rename from tests/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.test.yml rename to tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml index d01bbe2e34..9ad33f4fb5 100644 --- a/tests/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.test.yml +++ b/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml @@ -1,7 +1,7 @@ -name: Multiple Users Attempting To Authenticate Using Explicit Credentials Unit Test +name: Windows Users Authenticate Using Explicit Credentials Unit Test tests: -- name: Multiple Users Attempting To Authenticate Using Explicit Credentials - file: endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +- name: Windows Users Authenticate Using Explicit Credentials + file: endpoint/windows_users_authenticate_using_explicit_credentials.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 5f155e416684964646c4376dbf2ee013bae9fd1d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 17 Mar 2022 16:03:59 +0100 Subject: [PATCH 2/6] SSA add risk_score to package --- .../contentctl_infrastructure/adapter/obj_to_yml_adapter.py | 1 + .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 13ec4a0e4b..361910bb34 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -47,6 +47,7 @@ class ObjToYmlAdapter(Adapter): "kill_chain_phases": True, "mitre_attack_id": True, "risk_severity": True, + "risk_score": True, "security_domain": True, "required_fields": True }, diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml index 1901740dbd..d5123ab61a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -50,6 +50,7 @@ tags: - Processes.user - Processes.parent_process_name - Processes.parent_process + risk_score: 42 security_domain: endpoint risk_severity: low test: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index 1901740dbd..d5123ab61a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -50,6 +50,7 @@ tags: - Processes.user - Processes.parent_process_name - Processes.parent_process + risk_score: 42 security_domain: endpoint risk_severity: low test: From dbd047d93fc6a5342ca8d631847ca730d08d18d3 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 17 Mar 2022 12:11:50 -0700 Subject: [PATCH 3/6] Instead of just printing the total numbers of tests, passes, fails, and errors, print out the files that failed as well. --- .../ci/detection_testing_batch/summarize_json.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py index b9d5a9d822..01d1d4fdcf 100644 --- a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py +++ b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py @@ -61,9 +61,12 @@ def outputResultsJSON(output_filename:str, data:list[dict], baseline:OrderedDict fail_list = [os.path.join("security_content/detections",x['detection_file'] ) for x in data_sorted if x['success'] == False] if len(fail_list) > 0: - + print("FAILURES:") + for failed_test in fail_list: + print(f"\tfailed_test") failures_test_override = copy.deepcopy(summarization_reproduce_failure_config) - failures_test_override.update({"detections_list": fail_list, "no_interactive_failure":False, + #Force all tests to be interactive, even if they don't fail (because they failed on this test) + failures_test_override.update({"detections_list": fail_list, "no_interactive_failure":False, "interactive": True, "num_containers":1, "branch": baseline["branch"], "commit_hash":baseline["commit_hash"], "mode":"selected", "show_splunk_app_password": True}) with open(os.path.join(output_folder,failure_manifest_filename),"w") as failures: From 5b51b5d15e79418bea5e979819ea2038c4a48384 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 17 Mar 2022 12:26:35 -0700 Subject: [PATCH 4/6] Missing braces around fstring variable --- .../ci/detection_testing_batch/summarize_json.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py index 01d1d4fdcf..430af344fe 100644 --- a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py +++ b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py @@ -63,7 +63,7 @@ def outputResultsJSON(output_filename:str, data:list[dict], baseline:OrderedDict if len(fail_list) > 0: print("FAILURES:") for failed_test in fail_list: - print(f"\tfailed_test") + print(f"\t{failed_test}") failures_test_override = copy.deepcopy(summarization_reproduce_failure_config) #Force all tests to be interactive, even if they don't fail (because they failed on this test) failures_test_override.update({"detections_list": fail_list, "no_interactive_failure":False, "interactive": True, From d99e9e58e0b0b70138663be3885911629da4bc01 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 17 Mar 2022 15:24:40 -0700 Subject: [PATCH 5/6] name check only for ESCU --- .../domain/entities/detection.py | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 387f9afa43..9c2f74d1c0 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -52,11 +52,11 @@ class Detection(BaseModel, SecurityContentObject): source: str = None - @validator('name') - def name_max_length(cls, v): - if len(v) > 67: - raise ValueError('name is longer then 67 chars: ' + v) - return v + # @validator('name') + # def name_max_length(cls, v, values): + # if len(v) > 67: + # raise ValueError('name is longer then 67 chars: ' + v) + # return v @validator('name') def name_invalid_chars(cls, v): @@ -112,6 +112,14 @@ class Detection(BaseModel, SecurityContentObject): raise ValueError('Use source macro instead of eventtype, sourcetype, source or index in detection: ' + values["name"]) return values + @root_validator + def name_max_length(cls, values): + # Check max length only for ESCU searches, SSA does not have that constraint + if 'ssa_' not in values['file_path']: + if len(values["name"]) > 67: + raise ValueError('name is longer then 67 chars: ' + values["name"]) + return values + # @validator('references') # def references_check(cls, v, values): From 231774e65986d9a1ab515e7ca86b8443b4455d7d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 18 Mar 2022 07:50:37 +0100 Subject: [PATCH 6/6] SSA add risk_score to package --- ...hash_observed_at_the_destination_device.yml | 1 + ..._observed_by_an_event_collecting_device.yml | 1 + ..._unusual_lolbas_in_short_period_of_time.yml | 1 + .../ssa___anomalous_usage_of_archive_tools.yml | 18 ++++++------------ .../srs/ssa___attempt_to_delete_services.yml | 1 + .../srs/ssa___attempt_to_disable_services.yml | 1 + ...edential_dump_from_registry_via_reg_exe.yml | 1 + ...__bcdedit_failure_recovery_modification.yml | 1 + ...ear_unallocated_sector_using_cipher_app.yml | 1 + dist/ssa/srs/ssa___delete_a_net_user.yml | 1 + ...a___deny_permission_using_cacls_utility.yml | 1 + ..._detect_dump_lsass_memory_using_comsvcs.yml | 1 + ...rohibited_applications_spawning_cmd_exe.yml | 1 + .../ssa___detect_rclone_command_line_usage.yml | 1 + .../ssa/srs/ssa___disable_net_user_account.yml | 1 + ...a___dns_exfiltration_using_nslookup_app.yml | 3 ++- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 1 + ...___grant_permission_using_cacls_utility.yml | 1 + ...g_files_and_directories_with_attrib_exe.yml | 1 + ...ify_acls_permission_of_files_or_folders.yml | 1 + .../srs/ssa___resize_shadowstorage_volume.yml | 1 + .../ssa___sdelete_application_execution.yml | 1 + ...rocess_running_from_unexpected_location.yml | 1 + ...pting_interpreter_outbound_ldap_traffic.yml | 1 + .../ssa___wbadmin_delete_system_backups.yml | 1 + .../srs/ssa___wevtutil_usage_to_clear_logs.yml | 1 + .../ssa___wevtutil_usage_to_disable_logs.yml | 1 + .../srs/ssa___windows_bits_job_persistence.yml | 1 + .../ssa___windows_bitsadmin_download_file.yml | 1 + .../srs/ssa___windows_certutil_decode_file.yml | 1 + ...sa___windows_certutil_urlcache_download.yml | 1 + ...a___windows_certutil_verifyctl_download.yml | 1 + ...ndows_curl_upload_to_remote_destination.yml | 1 + ...sa___windows_diskshadow_proxy_execution.yml | 1 + .../srs/ssa___windows_eventvwr_uac_bypass.yml | 1 + .../srs/ssa___windows_mshta_child_process.yml | 1 + .../ssa___windows_mshta_command_line_url.yml | 1 + ...sa___windows_mshta_inline_hta_execution.yml | 1 + ..._connect_to_internet_with_hidden_window.yml | 1 + .../ssa___windows_powershell_downloadfile.yml | 1 + ...__windows_powershell_start_bitstransfer.yml | 1 + .../ssa___windows_rasautou_dll_execution.yml | 1 + ...__windows_rundll32_inline_hta_execution.yml | 1 + 43 files changed, 49 insertions(+), 13 deletions(-) diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index db66eff45f..50176b6c4d 100644 --- a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -65,6 +65,7 @@ tags: - dest_user_id - dest_device_id - authentication_method + risk_score: 72 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 35758d3d09..50017a1216 100644 --- a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -66,6 +66,7 @@ tags: - dest_user_id - origin_device_id - authentication_method + risk_score: 64 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml b/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml index b996ebc893..b19fe602bd 100644 --- a/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -63,6 +63,7 @@ tags: - dest_device_id - _time - process_name + risk_score: 25 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 1901740dbd..f0813ee8ba 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -12,18 +12,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%") OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name, - "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", start_time, - "detection_end_time", end_time, "device_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.device_entities.device.uid"), "string", null), "type_id", 0)], - "disposition_id", 1, "end_time", end_time, "event_id", 10100001, "event_time", timestamp, - "finding", create_map("confidence", 60, "confidence_id", 2, - "context_ids", [10, 49], "impact", 70, "impact_id", 4, - "kill_chain_phase", Exploitation, "kill_chain_phase_id", 4, - "risk_level", Medium, "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id), - "message", An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip., "metadata", create_map("log_name", Endpoint_Processes, "version", - "1.0.0"), "observables", , "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), - "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", start_time, - "user_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.user_entities.user.uid"),"string", null))]) - | into write_ssa_finding_events();' + "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", + parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -50,6 +43,7 @@ tags: - Processes.user - Processes.parent_process_name - Processes.parent_process + risk_score: 42 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index aebe900c07..cf50f2edcc 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -52,6 +52,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 36 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index bdd059f566..2cfaca6e36 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -51,6 +51,7 @@ tags: - process_path - dest_user_id - process + risk_score: 36 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8b42b91453..444dc103ae 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -47,6 +47,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 63 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 7ab53c507b..8613482410 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -44,6 +44,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index b068b2917e..9d6a6d9d0e 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -51,6 +51,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id + risk_score: 90 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 2217216c2c..b5436bb823 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -50,6 +50,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 49 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 29c9a012d1..71f24d112a 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -47,6 +47,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 449ccca1b0..0dcc8fa489 100644 --- a/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -41,6 +41,7 @@ tags: - _time - dest_device_id - process + risk_score: 70 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index c61e45042e..e2323fffa2 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -49,6 +49,7 @@ tags: - dest_device_id - dest_user_id - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 86cd481727..202e92675d 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -54,6 +54,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 547279b582..d2cac833f6 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -51,6 +51,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 49 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 0db340530b..88fa49daae 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -34,8 +34,8 @@ tags: analytic_story: - Suspicious DNS Traffic - Dynamic DNS - - Command & Control - Data Exfiltration + - Command and Control cis20: [] kill_chain_phases: - Exploitation @@ -51,6 +51,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 72 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 0c1c3bb568..203e1f5c4b 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -43,6 +43,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 54 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index b037795f9f..1c3841d8e4 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -47,6 +47,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index d4bbf1d5aa..e0a9b5940e 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -44,6 +44,7 @@ tags: - PR.IP required_fields: - _time + risk_score: 72 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 1d5b1fabca..d31616dc32 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -50,6 +50,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index d0f8bf116e..8d4dcab56f 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -50,6 +50,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 64 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 4d6b945ed1..de7c563f9b 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -59,6 +59,7 @@ tags: - process_id - process_path - cmd_line + risk_score: 42 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index f96f630ae5..cd38084f56 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -246,6 +246,7 @@ tags: - _time - dest_user_id - process_path + risk_score: 56 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 1ba0316e93..0441ccafe6 100644 --- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -48,6 +48,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: network risk_severity: low test: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 7d6fada37f..6af7c5e32c 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -48,6 +48,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 15 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 2e461702b1..ff2f683048 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -52,6 +52,7 @@ tags: - process_path - dest_user_id - process + risk_score: 63 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 635099699f..f94fc8ee9c 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -48,6 +48,7 @@ tags: - process_path - dest_user_id - process + risk_score: 63 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index e74510cc1b..c49263e82e 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -55,6 +55,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 56 security_domain: endpoint risk_severity: medium test: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 618b60249e..817a0573d7 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -59,6 +59,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 49 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index a66da327f2..26a4e9e2c6 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -53,6 +53,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 40 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 6f90885e09..cf7dbfc9fe 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -50,6 +50,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 90 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 5ebeb7e74f..289ffd16f8 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -51,6 +51,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 90 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 89f7971a3b..5fcfaa9bec 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -62,6 +62,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index bf3e0e467f..b146bf22e9 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -47,6 +47,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 49 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index f85e8c20f6..b700b3fb03 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -56,6 +56,7 @@ tags: - registry_value_type - registry_value_data - process_guid + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index b19a18915a..e4a86803d8 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -53,6 +53,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 17655034aa..065c2c4c90 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -55,6 +55,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 36cad740cd..783f2f883f 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -53,6 +53,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index d5ef0ec62c..4dfe024d7d 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -62,6 +62,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 3c21f70eeb..1e640f6906 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -55,6 +55,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 35 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 26f88372cf..581d1ac0d8 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -51,6 +51,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 49 security_domain: endpoint risk_severity: low test: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 4fd68ed7b6..ef9827d8bd 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -51,6 +51,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 80 security_domain: endpoint risk_severity: high test: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 5051572b45..88a090bba3 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -56,6 +56,7 @@ tags: - dest_user_id - process - cmd_line + risk_score: 56 security_domain: endpoint risk_severity: medium test: