mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'add_ui_to_escu' of github.com:splunk/security_content into add_ui_to_escu
This commit is contained in:
bpatel
@@ -0,0 +1,49 @@
|
||||
name: Disable Registry Tool
|
||||
id: cd2cf33c-9201-11eb-a10a-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identifies modification of registry to disable the
|
||||
regedit or registry tools of windows operating system. Since registry tool is a
|
||||
swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this
|
||||
application to prevent the removal of their registry entry such as persistence,
|
||||
file less components and defense evasion.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Disable Show Hidden Files
|
||||
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following search is to idetifies a modification in registry to prevent
|
||||
the user seeing all the files with hidden attributes. This event or techniques are
|
||||
known on some worm and trojan spy malware that will drop hidden files on the infected
|
||||
machine.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
|
||||
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path=
|
||||
"*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
|
||||
Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1564.001
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_nam
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,51 @@
|
||||
name: Disable Windows Behavior Monitoring
|
||||
id: 79439cae-9200-11eb-a4d3-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identifies a modification in registry to disable the
|
||||
windows denfender real time behavior monitoring. This event or technique is commonly
|
||||
seen in RAT, bot, or Trojan to disable AV to evade detections.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
|
||||
Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
|
||||
"*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
|
||||
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
|
||||
Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)"
|
||||
by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
|
||||
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin or user may choose to disable this windows features.
|
||||
references:
|
||||
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,49 @@
|
||||
name: Disable Windows SmartScreen Protection
|
||||
id: 664f0fd0-91ff-11eb-a56f-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following search identifies a modification of registry to disable
|
||||
the smartscreen protection of windows machine. This is windows feature provide an
|
||||
early warning system against website that might engage in phishing attack or malware
|
||||
distribution. This modification are seen in RAT malware to cover their tracks upon
|
||||
downloading other of its component or other payload.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name
|
||||
= "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
|
||||
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin or user may choose to disable this windows features.
|
||||
references:
|
||||
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_nam
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,48 @@
|
||||
name: Disabling CMD Application
|
||||
id: ff86077c-9212-11eb-a1e6-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to identify modification in registry to disable cmd prompt
|
||||
application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
|
||||
or deleting there samples through cmd application which is one of the tool of analyst
|
||||
to traverse on directory and files.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,47 @@
|
||||
name: Disabling ControlPanel
|
||||
id: 6ae0148e-9215-11eb-a94a-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to identify registry modification to disable control panel
|
||||
window. This technique is commonly seen in malware to prevent their artifacts ,
|
||||
persistence removed on the infected machine.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Disabling Firewall with Netsh
|
||||
id: 6860a62c-9203-11eb-9e05-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identifies suspicious firewall disabling using netsh
|
||||
application. this technique is commonly seen in malware that tries to communicate
|
||||
or download its component or other payload to its C2 server.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
|
||||
Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process=
|
||||
"*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`'
|
||||
how_to_implement: You must be ingesting data that records the filesystem activity
|
||||
from your hosts to populate the Endpoint file-system data model node. If you are
|
||||
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
||||
you want to collect data.
|
||||
known_false_positives: admin may disable firewall during testing or fixing network
|
||||
problem.
|
||||
references:
|
||||
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,49 @@
|
||||
name: Disabling FolderOptions Windows Feature
|
||||
id: 83776de4-921a-11eb-868a-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identify registry modification to disable folder options
|
||||
feature of windows to show hidden files, file extension and etc. This technique
|
||||
used by malware in combination if disabling show hidden files feature to hide their
|
||||
files and also to hide the file extension to lure the user base on file icons or
|
||||
fake file extensions.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,50 @@
|
||||
name: Disabling NoRun Windows App
|
||||
id: de81bc46-9213-11eb-adc9-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identify modification of registry to disable run application
|
||||
in window start menu. this application is known to be a helpful shortcut to windows
|
||||
OS user to run known application and also to execute some reg or batch script. This
|
||||
technique is used malware to make cleaning of its infection more harder by preventing
|
||||
known application run easily through run shortcut.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
- https://blog.malwarebytes.com/detections/pum-optional-norun/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,50 @@
|
||||
name: Disabling SystemRestore In Registry
|
||||
id: f4f837e2-91fb-11eb-8bf6-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following search identifies the modification of registry related
|
||||
in disabling the system restore of a machine. This event or behavior are seen in
|
||||
some RAT malware to make the restore of the infected machine difficult and keep
|
||||
their infection on the box.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
|
||||
NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
|
||||
NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name =
|
||||
"DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
|
||||
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: in some cases admin can disable systemrestore on a machine.
|
||||
references:
|
||||
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,49 @@
|
||||
name: Disabling Task Manager
|
||||
id: dac279bc-9202-11eb-b7fb-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to identifies modification of registry to disable the
|
||||
task manager of windows operating system. this event or technique are commonly seen
|
||||
in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
|
||||
their process.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
|
||||
Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: admin may disable this application for non technical user.
|
||||
references:
|
||||
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
||||
- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disable Registry Tool Unit Test
|
||||
tests:
|
||||
- name: Disable Registry Tool
|
||||
file: endpoint/disable_registry_tool.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disable Show Hidden Files Unit Test
|
||||
tests:
|
||||
- name: Disable Show Hidden Files
|
||||
file: endpoint/disable_show_hidden_files.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disable Windows Behavior Monitoring Unit Test
|
||||
tests:
|
||||
- name: Disable Windows Behavior Monitoring
|
||||
file: endpoint/disable_windows_behavior_monitoring.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disable Windows SmartScreen Protection Unit Test
|
||||
tests:
|
||||
- name: Disable Windows SmartScreen Protection
|
||||
file: endpoint/disable_windows_smartscreen_protection.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling CMD Application Unit Test
|
||||
tests:
|
||||
- name: Disabling CMD Application
|
||||
file: endpoint/disabling_cmd_application.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling ControlPanel Unit Test
|
||||
tests:
|
||||
- name: Disabling ControlPanel
|
||||
file: endpoint/disabling_controlpanel.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling Firewall with Netsh Unit Test
|
||||
tests:
|
||||
- name: Disabling Firewall with Netsh
|
||||
file: endpoint/disabling_firewall_with_netsh.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling FolderOptions Windows Feature Unit Test
|
||||
tests:
|
||||
- name: Disabling FolderOptions Windows Feature
|
||||
file: endpoint/disabling_folderoptions_windows_feature.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlogE
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling NoRun Windows App Unit Test
|
||||
tests:
|
||||
- name: Disabling NoRun Windows App
|
||||
file: endpoint/disabling_norun_windows_app.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling SystemRestore In Registry Unit Test
|
||||
tests:
|
||||
- name: Disabling SystemRestore In Registry
|
||||
file: endpoint/disabling_systemrestore_in_registry.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Disabling Task Manager Unit Test
|
||||
tests:
|
||||
- name: Disabling Task Manager
|
||||
file: endpoint/disabling_task_manager.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-system.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
source: WinEventLog:System
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
Reference in New Issue
Block a user